![]() Supplies a bin function for the StartTime parameter.Groups by start time and IP address to get a group for each session.Removes matches with earlier stop times. ![]() The join matches every start time with all the stop times from the same client IP address. | summarize arg_min(duration, *) by bin(StartTime,1s), ClientIp Pick out the earliest stop for each start and client: | project StopTime = timestamp, ClientIp) | project City, ClientIp, StartTime = timestamp Assuming each client address conducts only one session at a time, we can match each start event to the next stop event from the same IP address: ![]() ![]() But, we do have the IP address of the client in which the session took place. Suppose that the start and stop events don't conveniently have a session ID that we can match with.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |