We have a request from a client that they want to see how many hrs a user is using the foreground apps.
I have created a search like this but am stuck on how to show just in hrs
index=uberagent sourcetype="uberAgent:Session:SessionDetail" SessionUser="FCBOE\\chavouscr" SessionFgAppName!="Microsoft.LockApp"
| timechart span=1h count by SessionFgAppName limit=50 usenull=f
We want it to look like this
User _time Totalhrs
xyz 2/27/2020 4.3