Hi MarekS,
Check out this query and see if it works for you:
WVDConnections
| as ConnectionData
| where State == "Started"
| join kind = leftsemi
(
// Only include connections that actually reached the host to prevent short (failed) attempts from skewing the data
WVDCheckpoints
| where Source == "RDStack" and Name == "RdpStackConnectionEstablished"
) on CorrelationId
| join kind = leftsemi
(
WVDCheckpoints // New sessions only
| where Name == "LoadBalancedNewConnection"
| extend LoadBalanceOutcome=Parameters.LoadBalanceOutcome
| where (LoadBalanceOutcome == "NewSession")
) on CorrelationId
| join kind=innerunique // remove connections that do not have ShellStart
(
WVDCheckpoints
| where Name == "ShellStart"
| project ShellStart= TimeGenerated, CorrelationId
) on CorrelationId |project-away CorrelationId1
| join kind=leftanti // remove connections that have ShellReady
(
WVDCheckpoints
| where Name == "ShellReady"
| project ShellStart= TimeGenerated, CorrelationId
) on CorrelationId
| join kind=inner
(
WVDConnections
| where State == "Completed"
| project EndTime=TimeGenerated, CorrelationId
) on CorrelationId | project-away CorrelationId1
| project CorrelationId, UserName, TimeGenerated, Hostname = trim_end("[.].*", SessionHostName), Duration = EndTime -ShellStart