I'm trying to assist a customer with a query in Log Analytics to see whenever computers were turned on, by computer and by day.
I think I am on the right track in the Security Event table, going off of the Saved Search that Log Analytics offered for Logon Activity by Computer.
search in (SecurityEvent) EventID == 4624
| summarize LogonCount = count() by Computer
| limit 500000
I found a list of the event numbers (here: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/) and I believe 4608 "Windows is starting up" should work, but I can't seem to find where the options are to replace "LogonCount" with something that would indicate Windows starting instead. I'd also like to know how to sort that by computer and by day.
Your definition of idle is too vague. You will have to provide some explanation what you mean by idle time. There are thousand of performance counters on Windows Server and what Log Analytics gathers depends on what you've configured as data sources.
I do not think any of those two have some kind of performance counters. For example interactive logons can be tracked only as events. If interactive login happens event is logged one time in the security log. I am not aware of there are other events which you can distinguish if machine was powered on from sleep or shutdown.
About performance counters I do not know where the documentation is. There are some basic performance counters that are on every system and additional ones are installed depending on the role of the system. As far as I know you will not find user performance counters as all counters are related to the server itself rather users. I usually look at the performance counters from perfmon and than try to find if there is more information on specific counter on Internet.