Kusto Query to the earliest timestamp grouped by user_Id

Question

I'm just starting with kusto, and my journey was abruptly stopped by the problem of getting the list of user_Ids with the timestamp of the very first customEvent sent by a user in the given time frame.

How should I modify my query to get the results (let's assume that the limiting timespan is 30days)

customEvents 
| where timestamp >= ago(30d)
| summarize min(timestamp)

Answer 1

If you want to get just the min of the timestamp just add the "by" clause:

customEvents 
| where timestamp >= ago(30d)
| summarize min(timestamp) by user_Id

If you want to get the full row, use arg_min() function, for example:

customEvents 
| where timestamp >= ago(30d)
| summarize arg_min(timestamp, *) by user_Id