filter @message like /Process exited/
| stats count() by bin(30m)