KQL Search

// TotalTokens is not exposed in CopilotActivity today, so we use the
// sum of Messages[] cardinality per hour per agent+user as a usage proxy.
// Pair with CopilotTraceLevelAnomalies hunting query for context.
let lookback = 7d;
let recentWindow = 1h;
let perHour =
    CopilotActivity
    | where TimeGenerated > ago(lookback)
    | where RecordType == "CopilotInteraction"
    | extend MsgCount = array_length(LLMEventData.Messages)
    | summarize
        HourMessages = sum(MsgCount),
        HourInteractions = count(),
        AnyActor = take_any(ActorName)
        by AgentId, AgentName, ActorUserId, Hour = bin(TimeGenerated, 1h);
let baseline =
    perHour
    | where Hour < bin(now(), 1h) - recentWindow
    | summarize
        MedianHourMessages = percentile(HourMessages, 50),
        P95HourMessages = percentile(HourMessages, 95)
        by AgentId, AgentName, ActorUserId;
let recent =
    perHour
    | where Hour >= bin(now(), 1h) - recentWindow;
recent
| join kind=leftouter baseline on AgentId, ActorUserId
| extend
    MedianHourMessages = coalesce(todouble(MedianHourMessages), 0.0),
    P95HourMessages = coalesce(todouble(P95HourMessages), 0.0)
| extend SpikeRatio = iff(MedianHourMessages > 0, todouble(HourMessages) / MedianHourMessages, todouble(HourMessages))
| where HourMessages > 100
    and (SpikeRatio >= 3.0 or HourMessages > P95HourMessages * 2)
| extend ActorName = AnyActor
| project
    Hour, AgentId, AgentName, ActorName, ActorUserId,
    HourInteractions, HourMessages, MedianHourMessages,
    P95HourMessages, SpikeRatio