KQL Search

This KQL (Kusto Query Language) query is designed to analyze heartbeat data from virtual machines over the past 24 hours. Here's a breakdown of what it does in simple terms:

1. Define Time Period: It sets a time period of the last 24 hours (query_period = 24h).

2. Filter Data: It filters the Heartbeat table to include only records where the TimeGenerated timestamp is within the last 24 hours.

3. Summarize Data: It groups the data by Category, VMUUID, Computer, and _ResourceId, and for each group, it selects the record with the most recent TimeGenerated timestamp. This is done using the arg_max function, which returns the row with the maximum value of TimeGenerated for each group.

4. Sort Data: It sorts the resulting data in ascending order based on Computer, VMUUID, Category, and SourceComputerId.

5. Reorder Columns: Finally, it rearranges the columns to display Category, TimeGenerated, Computer, ComputerIP, and ComputerPrivateIPs in that specific order.

In summary, the query retrieves the latest heartbeat information for each unique combination of category, virtual machine, and computer over the past day, sorts the results, and organizes the output to focus on specific columns.