Azure 虚拟桌面 KQL (Kusto) 查询

Question

我正在寻找一个

KQL

(Kusto) 查询，它可以从 Log Analytics 工作区提供 Azure 虚拟桌面主机池的每个应用程序或每个应用程序组的用户总数。 此查询给出了每个主机池的用户总数，但我想进一步区分：

WVDConnections
| where TimeGenerated > ago(7d) 
| where State == "Connected" 
| project _ResourceId, UserName
| project-rename Hostpool = _ResourceId 
| summarize DistinctUsers= dcount(UserName) by Hostpool
| extend HostPool=toupper(strcat(split(Hostpool, "/")[4], ".", split(Hostpool, "/")[8]))
| project HostPool, DistinctUsers

谢谢！

它没有提供足够的信息。

Answer 1

您已经尝试过了吗（数据表仅用于测试目的）：

let WVDConnections = datatable(TimeGenerated: datetime, UserName: string, ApplicationGroupName: string)
[
    datetime(2024-07-01 08:00:00), "[email protected]", "DesktopGroup1",
    datetime(2024-07-02 09:00:00), "[email protected]", "DesktopGroup1",
    datetime(2024-07-03 10:00:00), "[email protected]", "RemoteAppGroup1",
    datetime(2024-07-04 11:00:00), "[email protected]", "RemoteAppGroup1",
    datetime(2024-07-05 12:00:00), "[email protected]", "DesktopGroup2",
    datetime(2024-07-07 13:00:00), "[email protected]", "RemoteAppGroup2",
    datetime(2024-07-07 14:00:00), "[email protected]", "RemoteAppGroup2",
    datetime(2024-07-08 15:00:00), "[email protected]", "DesktopGroup1",
    datetime(2024-07-09 16:00:00), "[email protected]", "DesktopGroup2",
    datetime(2024-07-10 17:00:00), "[email protected]", "RemoteAppGroup2"
];
WVDConnections
| where TimeGenerated >= ago(10d) 
| summarize Users = make_set(UserName) by ApplicationGroupName
| project ApplicationGroupName, Users

示例代码在这里。