Forum Discussion

Dillon Brown's avatar
Dillon Brown
Icon for Microsoft rankMicrosoft
Nov 21, 2017
Solved

Query for computer start events

Hi everyone, I'm trying to assist a customer with a query in Log Analytics to see whenever computers were turned on, by computer and by day. I think I am on the right track in the Security Event ...
  • Hi Here we go search in (SecurityEvent) EventID == 4624 | summarize WindowsStartCount = count() by Computer, bin(TimeGenerated, 1d)

Resources