Application Insights Log Query Get Latest Row in a Group

Question

I'm trying to find the latest row of each member of a group in Application Insights.

Here's the query:

traces | 
where timestamp > ago(1h) | 
where message startswith "TEST DONE" | 
order by timestamp desc nulls last |  
extend json=parse_json(substring(message,10))  | 
summarize  any(timestamp, tostring(json.status)) by tostring(json.testKey)

It does return just one row but it's not the latest, it's any random row from the set of possible rows.

Answer 1

I think you're looking for the arg_max function?

https://learn.microsoft.com/en-us/azure/kusto/query/arg-max-aggfunction

something like:

traces | 
where timestamp > ago(1h) | 
where message startswith "TEST DONE" | 
order by timestamp desc nulls last |  
extend json=parse_json(substring(message,10))  | 
extend testKey = tostring(json.testKey) |
extend status = tostring(json.status) |
summarize arg_max(timestamp, status) by testKey