Oct 22 2020
- last edited on
Apr 08 2022
I am running Azure WVD connected into LogAnalytics and I would like to create a chart showing the number of concurrent users per hour over the previous week.
I have written this query (currently limited to just a specific user for testing):
let Events = WVDConnections | where UserName == "email@example.com"; Events | where State == "Connected" | project CorrelationId , UserName, StartTime=TimeGenerated, State | join ( Events | where State == "Completed" | project EndTime=TimeGenerated, CorrelationId, State ) on CorrelationId | project UserName, CorrelationId, State, State1, StartTime, EndTime | sort by StartTime desc
Which gives me the below tabular output (I have included the state and state1 columns for clarity):
| make-series count(UserName) default=0 on StartTime from ago(7d) to now() step 15m
Oct 23 2020 01:12 AM
Any ideas on this anyone - is this even possible in KQL?
Oct 23 2020 03:39 AM
Have you looked at the Workbook for WVD, you can see the many KQL examples used by this when you open it in edit mode?
Oct 23 2020 03:44 AM
Yeah - have checked through there and I can see no queries or similar one that do what I want to do in my question