Jan 16 2023
Below gives me a table of distinct usernames
| take 100
| sort by TimeGenerated asc, CorrelationId
| distinct UserName
Below gives me a session duration for a single user, but i have to manually type in the UserName
let Events = WVDConnections | where UserName == "userupn" ;
| where State == "Connected"
| project CorrelationId , UserName, ResourceAlias , StartTime=TimeGenerated
| join (Events
| where State == "Completed"
| project EndTime=TimeGenerated, CorrelationId)
| project Duration = EndTime - StartTime, ResourceAlias
| sort by Duration asc
How can I combine both queries to get result for each user. If it was powershell or python, I would loop through the list given by 1srt query. Not sure how to do in KQL
Above query copied from https://learn.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics?source=docs