Forum Discussion
KQL Query to summerize session counts over time
Hello folks, I'm trying to find a "good" way to achieve what I think is a simple task but cannot think of a simple solution. I have logs with session information, one entry per session St...
How about this:
let binSize = 5m;
Sessions
| extend StartBin = bin(StartTime, binSize)
| extend EndBin = bin(EndTime, binSize)
| mv-expand TimeBin = range(StartBin, EndBin, binSize)
| summarize ActiveSessions = count() by TimeBin
| order by TimeBin asc