KQL loop through results of query1 in query 2

Copper Contributor

Below gives me a table of distinct usernames

 

WVDConnections 
| take 100 
| sort by TimeGenerated asc, CorrelationId 
| distinct  UserName

Below gives me a session duration for a single user, but i have to manually type in the UserName

 

let Events = WVDConnections | where UserName == "userupn" ;
Events
| where State == "Connected"
| project CorrelationId , UserName, ResourceAlias , StartTime=TimeGenerated
| join (Events
| where State == "Completed"
| project EndTime=TimeGenerated, CorrelationId)
on CorrelationId
| project Duration = EndTime - StartTime, ResourceAlias
| sort by Duration asc

How can I combine both queries to get result for each user. If it was powershell or python, I would loop through the list given by 1srt query. Not sure how to do in KQL

 

Above query copied from https://learn.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics?source=docs 

0 Replies