Hi,
Anyone have idea about how to get latest aggregation time from any source(s) using search query in IdentityNow Search functionality.
I am able to get all the aggregation time but we need only the latest one. I can see in the source, the attribute (lastAggregationDate_account) is present but not sure how to get that in search.
Using the below search query will give you the aggregation Events for your source.
name:"Aggregate Source Account" AND target.name:"Your Source Name" AND created:[now-1h TO now]
The “Aggregate Source Account Started” will give you start time of aggregation and “Aggregate Source Account Passed” gives you the aggregation completion time.
You can modify the query further to fit your requirement.
Hi Sharvari, thanks for the response.
We already have below query
attributes.sourceName:(“<Source Name(s)>”) AND created:[now-6w TO now] AND operation:Aggregate AND status:PASSED
This gives us all the aggregation dates from today, but what we are looking for is the when the last successful aggregation happened on any connector, it doesn’t matter if the aggregation ran 2 days back or today, we are expecting only 1 record per source.
Search functionality doesn’t have that option to just show/export the first row or just one row.
Wish there were options like created:MAX(created) that would return the row with latest created date 
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.