UniFi Site Manager: System log shipping disabled

Requête originale, sans modification.

let prev = Unifi_SiteManager_Hosts_CL
          | where TimeGenerated between (ago(30m) .. ago(15m))
          | summarize arg_max(TimeGenerated, *) by Id
          | project id_s = Id, prevState = tostring(ReportedState.cloudSystemLogState);
      Unifi_SiteManager_Hosts_CL
      | where TimeGenerated > ago(15m)
      | summarize arg_max(TimeGenerated, *) by Id
      | extend id_s = Id,
               SiteName = tostring(ReportedState.name),
               currentState = tostring(ReportedState.cloudSystemLogState)
      | join kind=inner prev on id_s
      | where currentState == 'disabled' and prevState == 'enabled'
      | extend Activity = strcat('Cloud system log shipping was disabled on host ', SiteName, ' (', prevState, ' -> ', currentState, ')')
      | project TimeGenerated, Id, SiteName, Activity, prevState, currentState