WVDCheckpoints table, how do I find out what server the user was on when entry made?

joellopez 

I think I may have found my solution on this page:
https://blog.itprocloud.de/Windows-Virtual-Desktop-Monitoring-the-Spring-backend/

I just had to modify it a bit to add the filter by the host name and add the client IP.

WVDConnections
| where Type =~"WVDConnections" and State =~ "Started"
| extend Multi=split(_ResourceId, "/") | project ResourceAlias, ClientSideIPAddress, HostPool=toupper(HP=Multi[8]), SessionHostName , UserName ,CState=iff(SessionHostOSVersion=="<>","Failure","Success"), CorrelationId, TimeGenerated, ResourceGroup=Multi[4], DesktopGroup_s=toupper(strcat(RG=Multi[4],".", HP=Multi[8]))
| join kind= leftouter (
WVDCheckpoints
) on CorrelationId
| extend DurationFromLogon=datetime_diff("Second",TimeGenerated1,TimeGenerated)
| where Name=~"RdpStackLogon"
| where SessionHostName contains "hp1-1"
| project UserName, ClientSideIPAddress, SessionHost=SessionHostName, TimeStamp=TimeGenerated1, DurationFromLogon
| order by SessionHost, TimeStamp desc

This will give me the login times and duration of the users on a server so I can find out when started getting slow.  Here you can see how it improved after we rebooted it.

Now that I know what day it started I have to figure out where to look next to find out what is causing it.  If you have any ideas please share.  I'm pretty new at this.  

In the mean time if you have any tips on how to set up an alert when logins take more than 20 seconds I'd also appreciate it.