knn-geo.kql

let telemetryData = datatable (deviceid: string, ts: datetime, latitude: real, longitude: real) [
    "alice",datetime(2022-11-07T23:11:19Z),real(47.6423771),real(-122.1267281),
    "alice",datetime(2022-11-07T23:11:20Z),real(47.6424771),real(-122.1277281),
    "alice",datetime(2022-11-07T23:11:21Z),real(47.6425771),real(-122.1287281),
    "bob",datetime(2022-11-07T23:11:19Z),real(47.6424771),real(-122.1287281),
    "bob",datetime(2022-11-07T23:11:20Z),real(47.6424771),real(-122.1287281),
    "carol",datetime(2022-11-07T23:11:22Z),real(47.6423771),real(-122.1267281),
    "carol",datetime(2022-11-07T23:11:22Z),real(47.6523771),real(-122.1267281),
    "carol",datetime(2022-11-07T23:11:24Z),real(47.6623771),real(-122.1267281),
    "dave",datetime(2022-11-07T23:11:24Z),real(47.644205),real(-122.1412026),
    "dave",datetime(2022-11-07T23:11:25Z),real(47.6442096),real(-122.1410886)
];
let timeClusterWindow = 6s;
let nNearestNeighbors = 3;
let filteredData = materialize(telemetryData
| summarize latitude = avg(latitude), longitude = avg(longitude) by deviceid, timeCluster = bin(ts, timeClusterWindow)
| extend dummy=1);
filteredData
| join kind=fullouter filteredData on dummy, timeCluster
| where deviceid != deviceid1
| extend distance = round(geo_distance_2points(longitude, latitude, longitude1, latitude1),1)
|   top-nested   of deviceid   by tmp = max(1),
    top-nested nNearestNeighbors of neighbor=deviceid1 by min_distance=min(distance) asc 
| project-away tmp