Supplies a bin function for the StartTime parameter.Groups by start time and IP address to get a group for each session.Removes matches with earlier stop times.The join matches every start time with all the stop times from the same client IP address. | summarize arg_min(duration, *) by bin(StartTime,1s), ClientIp Pick out the earliest stop for each start and client: | project StopTime = timestamp, ClientIp)

| project City, ClientIp, StartTime = timestamp Assuming each client address conducts only one session at a time, we can match each start event to the next stop event from the same IP address: But, we do have the IP address of the client in which the session took place. Suppose that the start and stop events don't conveniently have a session ID that we can match with. Use project again to add a column to show the duration of the activity.Use join to match the start and stop entries for the same activity.project also selects the other columns to view in the results. Use project to change the names of the timestamps so that both the start time and the stop time appear in the results.Use let to name a projection of the table that's pared down as far as possible before starting the join.To match start and stop events with a session ID: | project City, SessionId, StartTime, StopTime, Duration = StopTime - StartTime | project Name, City, SessionId, StartTime=timestamp The challenge is to match start and stop events with a session ID.Įxample: let Events = MyLogTable | where. NameĮvery event has a session ID ( SessionId). In a log of events, some events mark the start or end of an extended activity or session. Sort the results to define the order of the x-axis.Use where, summarize, and top to limit the volume of data you display.| summarize event_count=count() by EndLocation To project two or more columns, and then use the columns as the x-axis and y-axis of a chart: StormEvents This article identifies common queries and how you can use the Kusto Query Language to meet them.

Summarize app