I am trying to create a WVD Dashboard chart showing all my hosts/users RTT values and have noticed that the data in the resulting chart is wrong. On further investigation I can see for each given time step where the performance data is gathered for each host, there are multiple RTT values (and each one has a different "InstanceName"), not all but a lot of the hosts have multiple values. What the chart query is doing, is then averaging all these values and coming up with a wrong(?) value for the chart:
So, with one user connecting to the machine, why am I seeing multiple RTT values - each one with a different InstanceName?
And, how do I derive the "correct" RTT value from that list for the active user for display on the chart?
I have taken a guess that the highest InstanceName (Session ID) must be the currently active users session RTT (but what are all the others and where to they come from as they all have different RTT's?)
I have created a query that should return the highest InstanceName's RTT value for each WVD Session Host at each time step - any ideas if my guess is right and does the code below do what I think it should?
| where ObjectName == "RemoteFX Network" and CounterName == "Current TCP RTT"
| where Computer contains "AZUCAD"
| extend Multi=split(InstanceName," ")
| project TimeGenerated, Computer, CounterValue, SessionNumber=toint(Multi)
| summarize MaxSession=arg_max(SessionNumber,*) by bin(TimeGenerated, 10m), Computer
| project-away MaxSession, TimeGenerated1