Getting HRS of Foreground Apps

We have a request from a client that they want to see how many hrs a user is using the foreground apps.

I have created a search like this but am stuck on how to show just in hrs

index=uberagent sourcetype="uberAgent:Session:SessionDetail" SessionUser="FCBOE\\chavouscr" SessionFgAppName!="Microsoft.LockApp"
| timechart span=1h count by SessionFgAppName limit=50 usenull=f


We want it to look like this 

User   _time          Totalhrs

xyz     2/27/2020    4.3

1 comment

  • Avatar
    Martin Kretzschmar Official comment

    Hi Jonathan,

    The following search will show you the percentage of the applications foreground time, depending on the selected time range.

    | pivot `uA_DM_Session_SessionDetail_Users` Session_SessionDetail_Users
    count(SessionFgAppName) as CountSessionFgAppName
    latest(User) as User
    splitrow SessionGUID
    | join type=left SessionGUID
    | pivot `uA_DM_Session_SessionDetail_Users` Session_SessionDetail_Users
    count(SessionFgAppName) as CountSessionFgAppNamebyUser
    | eval "Application in foreground (%)"= round(CountSessionFgAppName / CountSessionFgAppNamebyUser * 100, 1)
    | rename SessionFgAppName as AppName
    | fields User AppName "Application in foreground (%)"
    | sort User

    In addition, please have a look at the following articles, as they might be useful to your case as well.


Please sign in to leave a comment.