I would like to have a query to export the first signin for each user per day.
i.e. i would like to know the first time this user signedin each day.
thank you for your support
| where TimeGenerated > startofday(ago(0d))
| summarize Count = count() , arg_min(TimeGenerated, *) by UserDisplayName
| order by Count desc, UserDisplayName asc
arg_min, will finds the first occurrence for you.
Working :), thank you dear. Appreciated.
March 30, 2020
April 25, 2019