Here’s another nifty little trick useful for counting how many unique users were impacted from a service issue.

In order to do this, I use the “dcount” aggregation. It counts how many unique values are in the column.

requests
| where timestamp > ago(7d)
| where resultCode == "404"
| summarize dcount(user_Id)