Sure, here's the modified query using msfsi instead of msemr and msind, and grouping the results for the past 1 day, past 7 days, and past 28 days:
let MC4HTenantIDs = cluster('https://kvctc5gupd52uupznj00ej.southcentralus.kusto.windows.net').database('girishrajadb1').MC4HTenants20230313 | project TenantId; cluster('capanalytics').database('CRMAnalytics').CDSUsageDetail | where TenantID in (MC4HTenantIDs) | where Date >= ago(28d) | where Entity contains "msfsi_" or AppName contains "msfsi" | summarize dcount(UserID), dcount(TenantID) by AppName, bin(Date, 1d, now()) | order by Date asc, AppName asc, dcount_UserID asc, dcount_TenantID asc | render timechart
This query groups the results by AppName and by date using the bin()
function. The render timechart
command generates a graphical output that shows the results over time. Note that the order by
clause sorts the results by date, AppName, dcount_UserID, and dcount_TenantID in ascending order.