Queries for the ConfigurationData table
For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.
Recent stopped auto services
Shows most recent services that were set to Auto but reported as being stopped.
ConfigurationData
| where ConfigDataType == "WindowsServices" and SvcStartupType == "Auto"
| where SvcState == "Stopped"
| summarize arg_max(TimeGenerated, *) by SoftwareName, Computer