Jan 16 2023 11:44 PM
Below gives me a table of distinct usernames
WVDConnections | take 100 | sort by TimeGenerated asc, CorrelationId | distinct UserName
Below gives me a session duration for a single user, but i have to manually type in the UserName
let Events = WVDConnections | where UserName == "userupn" ; Events | where State == "Connected" | project CorrelationId , UserName, ResourceAlias , StartTime=TimeGenerated | join (Events | where State == "Completed" | project EndTime=TimeGenerated, CorrelationId) on CorrelationId | project Duration = EndTime - StartTime, ResourceAlias | sort by Duration asc
How can I combine both queries to get result for each user. If it was powershell or python, I would loop through the list given by 1srt query. Not sure how to do in KQL
Above query copied from https://learn.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics?source=docs