Using log analytics KQL query on Perf table we can get CPU utilization for machine level but unable to find user wise CPU utilization. Perf | where CounterName == '% Processor Time' and ObjectName == 'Process' Using the above query we can %CPU vs process and using VMProcess table we get process vs user data. As process to user is not a one-to-one mapping, I realized that this way we can't get % CPU used by each user. Please suggest a way.