{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/", "slug": "dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing", "url": "https://update.dsesecurity.com/updates/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/" }, "title": "Reconcile a Log Analytics volume spike against receipt time before changing collection", "summary": "Why can an ingestion-volume increase be missing from records grouped by event time?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:23:38+00:00", "modified_at": "2026-09-10T02:08:05+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 246, "potentially_affected": "Log Analytics investigations comparing Usage records with raw records grouped by TimeGenerated.", "dse_recommendation": "Compare receipt time with event time for the implicated table before interpreting the mismatch as changed workload activity.", "primary_source": { "name": "Analyze usage in a Log Analytics workspace in Azure Monitor - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/analyze-usage", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

A Log Analytics Usage increase can disagree with raw-record totals grouped by TimeGenerated when older events arrive late. Microsoft gives disconnected agents sending accumulated data and incorrect host clocks as examples. The _TimeReceived field records arrival at Azure Monitor; comparing it with TimeGenerated helps investigate that discrepancy. Usage’s StartTime and EndTime describe its reporting buckets. Microsoft Learn.

\n

Applicability

\n

Use this investigation when receipt-oriented usage and event-time analysis disagree. The examples are possible explanations, not a diagnosis of the organization’s hosts. Identify the affected table and interval before widening the search or assuming new activity occurred at the same time as ingestion.

\n

DSE recommendation

\n

Compare receipt time with event time for the implicated table before interpreting the mismatch as changed workload activity. Ask the collection owner to retain the spike interval and the query definitions used on both sides. Examine the event-time distribution within that receipt interval, then relate any older records to actual agent connectivity and clock evidence. Avoid immediately reducing collection to hide a spike whose origin is still unknown.

\n

Verification

\n

Run a bounded table-specific comparison and preserve the arrival interval, event-time grouping and observed record totals. Confirm that the query’s time scope can include the older events being investigated. Document whether the evidence supports delayed delivery, a timestamp problem, another explanation, or an unresolved mismatch. Do not label historical records as newly generated solely because they became visible during the spike.

\n

Official references

\n

Microsoft Learn: Analyze Log Analytics usage. Source reviewed September 9, 2026.

", "content_text": "Source facts\nA Log Analytics Usage increase can disagree with raw-record totals grouped by TimeGenerated when older events arrive late. Microsoft gives disconnected agents sending accumulated data and incorrect host clocks as examples. The _TimeReceived field records arrival at Azure Monitor; comparing it with TimeGenerated helps investigate that discrepancy. Usage’s StartTime and EndTime describe its reporting buckets. Microsoft Learn.\nApplicability\nUse this investigation when receipt-oriented usage and event-time analysis disagree. The examples are possible explanations, not a diagnosis of the organization’s hosts. Identify the affected table and interval before widening the search or assuming new activity occurred at the same time as ingestion.\nDSE recommendation\nCompare receipt time with event time for the implicated table before interpreting the mismatch as changed workload activity. Ask the collection owner to retain the spike interval and the query definitions used on both sides. Examine the event-time distribution within that receipt interval, then relate any older records to actual agent connectivity and clock evidence. Avoid immediately reducing collection to hide a spike whose origin is still unknown.\nVerification\nRun a bounded table-specific comparison and preserve the arrival interval, event-time grouping and observed record totals. Confirm that the query’s time scope can include the older events being investigated. Document whether the evidence supports delayed delivery, a timestamp problem, another explanation, or an unresolved mismatch. Do not label historical records as newly generated solely because they became visible during the spike.\nOfficial references\nMicrosoft Learn: Analyze Log Analytics usage. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nA Log Analytics Usage increase can disagree with raw-record totals grouped by TimeGenerated when older events arrive late. Microsoft gives disconnected agents sending accumulated data and incorrect host clocks as examples. The _TimeReceived field records arrival at Azure Monitor; comparing it with TimeGenerated helps investigate that discrepancy. Usage’s StartTime and EndTime describe its reporting buckets. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/analyze-usage).\n\n## Applicability\n\nUse this investigation when receipt-oriented usage and event-time analysis disagree. The examples are possible explanations, not a diagnosis of the organization’s hosts. Identify the affected table and interval before widening the search or assuming new activity occurred at the same time as ingestion.\n\n## DSE recommendation\n\nCompare receipt time with event time for the implicated table before interpreting the mismatch as changed workload activity. Ask the collection owner to retain the spike interval and the query definitions used on both sides. Examine the event-time distribution within that receipt interval, then relate any older records to actual agent connectivity and clock evidence. Avoid immediately reducing collection to hide a spike whose origin is still unknown.\n\n## Verification\n\nRun a bounded table-specific comparison and preserve the arrival interval, event-time grouping and observed record totals. Confirm that the query’s time scope can include the older events being investigated. Document whether the evidence supports delayed delivery, a timestamp problem, another explanation, or an unresolved mismatch. Do not label historical records as newly generated solely because they became visible during the spike.\n\n## Official references\n\n[Microsoft Learn: Analyze Log Analytics usage](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/analyze-usage). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/", "url": "https://update.dsesecurity.com/updates/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Reconcile a Log Analytics volume spike against receipt time before changing collection", "item": "https://update.dsesecurity.com/updates/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/", "url": "https://update.dsesecurity.com/updates/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/", "headline": "Reconcile a Log Analytics volume spike against receipt time before changing collection", "description": "Why can an ingestion-volume increase be missing from records grouped by event time?", "abstract": "Why can an ingestion-volume increase be missing from records grouped by event time?", "articleBody": "Source facts\nA Log Analytics Usage increase can disagree with raw-record totals grouped by TimeGenerated when older events arrive late. Microsoft gives disconnected agents sending accumulated data and incorrect host clocks as examples. The _TimeReceived field records arrival at Azure Monitor; comparing it with TimeGenerated helps investigate that discrepancy. Usage’s StartTime and EndTime describe its reporting buckets. Microsoft Learn.\nApplicability\nUse this investigation when receipt-oriented usage and event-time analysis disagree. The examples are possible explanations, not a diagnosis of the organization’s hosts. Identify the affected table and interval before widening the search or assuming new activity occurred at the same time as ingestion.\nDSE recommendation\nCompare receipt time with event time for the implicated table before interpreting the mismatch as changed workload activity. Ask the collection owner to retain the spike interval and the query definitions used on both sides. Examine the event-time distribution within that receipt interval, then relate any older records to actual agent connectivity and clock evidence. Avoid immediately reducing collection to hide a spike whose origin is still unknown.\nVerification\nRun a bounded table-specific comparison and preserve the arrival interval, event-time grouping and observed record totals. Confirm that the query’s time scope can include the older events being investigated. Document whether the evidence supports delayed delivery, a timestamp problem, another explanation, or an unresolved mismatch. Do not label historical records as newly generated solely because they became visible during the spike.\nOfficial references\nMicrosoft Learn: Analyze Log Analytics usage. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:23:38+00:00", "dateModified": "2026-09-10T02:08:05+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-498-reconcile-a-log-analytics-volume-spike-against-receipt-time-before-changing/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Reconcile a Log Analytics volume spike against receipt time before changing collection" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 246, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Analyze usage in a Log Analytics workspace in Azure Monitor - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/analyze-usage" } } ] } }