30 Dec 2024 10:45 AM
30 Dec 2024 07:06 PM
If you are looking for earliest (and maybe latest too) timestamp of log line with particular correlation in, it could look like this:
| summarize { start_time=min(timestamp), end_time=max(timestamp)}, by: {corrleation_id}
but I may be incorrectly interpreting your need.
Example on test data looks like this: