0

I am looking to get statistics on people logged onto a Remote Desktop Application pool within a date range.

I have created a powershell script which counts the number of sessions for a specific application pool and then logs a custom event to the Application log with that figure.

On log analytics I have set up a custom field which extracts this figure from the custom event log and it is set to numeric. I then create a query to extract the data as below:

Event | 
where Source == "myapp" and EventID == 1 |
project toint(MYAPPUSERCOUNT3_CF)

When I try to generate a chart then I get the error below:

The Stacked Column can't be created as you are missing a column of one of the following types: Int32, Int64, Single or Double

I can understand why this is happening because the Column is numeric and not int, but is there a way around this.

I might be approaching this the wrong way. I am thinking that I might be able to capture events from the RD gateway server that show logons to the application pool, if such an event exists. Does anyone know the event to capture as I can't find this online?

Sorry, as I am very new to Log Analytics.

OptimusPrime
  • 777
  • 16
  • 25

2 Answers2

0

Please try with the below query.

Event | 
where Source == "myapp" and EventID == 1 |
summarize AggregatedValue = count() by MYAPPUSERCOUNT3_CF |
render barchart

Hope this helps!!

KrishnaG
  • 3,340
  • 2
  • 6
  • 16
  • Thanks, I will give this a go when I am in work on Monday and let you know. – OptimusPrime Mar 16 '19 at 07:42
  • Thanks, I think I have got it closer to what I want to achieve. For what I need, the aggregate function wasn't required. I needed to project the values for the time logged and the MYAPPUSERCOUNT3_CF value, then render as a barchart. I guess the project is the equivalent of select in SQL. It was the render barchart that I needed to get it to work in the way I wanted. – OptimusPrime Mar 18 '19 at 09:08
0

This is the code that worked for me:

Event | 
where Source == "myapp" and EventID == 1 |
project TimeGenerated, toint(MYAPPUSERCOUNT3_CF) |
render timechart
OptimusPrime
  • 777
  • 16
  • 25