SigninLogs
| where TimeGenerated > ago(1d)
| extend locationString = strcat(
tostring(LocationDetails[“countryOrRegion”]), “/”,
tostring(LocationDetails[“state”]), “/”,
tostring(LocationDetails[“city”]), “;”
)
| project TimeGenerated, AppDisplayName, UserPrincipalName, locationString
| make-series dLocationCount = dcount(locationString)
on TimeGenerated step 1d
by UserPrincipalName, AppDisplayName
| extend (RSquare, Slope, Variance, RVariance, Interception, LineFit)
= series_fit_line(dLocationCount)
| top 3 by Slope desc