0

I'm just starting with kusto, and my journey was abruptly stopped by the problem of getting the list of user_Ids with the timestamp of the very first customEvent sent by a user in the given time frame.

How should I modify my query to get the results (let's assume that the limiting timespan is 30days)

customEvents 
| where timestamp >= ago(30d)
| summarize min(timestamp)
DegH
  • 53
  • 8

1 Answers1

4

If you want to get just the min of the timestamp just add the "by" clause:

customEvents 
| where timestamp >= ago(30d)
| summarize min(timestamp) by user_Id

If you want to get the full row, use arg_min() function, for example:

customEvents 
| where timestamp >= ago(30d)
| summarize arg_min(timestamp, *) by user_Id
Avnera
  • 7,088
  • 9
  • 14
  • oh arg_min is wicked, thank you! For future reference it would be better to change UserId into user_Id - then both queries will be ready to run. Thanks once again! – DegH Jan 14 '21 at 10:27