How to use Kusto to return a max() row from a table, while showing other columns not used in the max grouping

Question

Given the following Log analytics KQL query:

SigninLogs 
| where ResultType == 0 
| summarize max(TimeGenerated) by UserPrincipalName

I need to display other columns from those selected rows in the SigninLogs table. I've tried different approaches with no success. Joining back to the same table again seems unfeasible as joins appear to only be available using a single column. Other approaches using in failed because the needed columns weren't available in the above source query.

Answer 1

You can use the arg_max() aggregation function: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/arg-max-aggfunction