SELECT
— [COGIPF_HOST_IPADDR]
— ,[COGIPF_HOST_PORT]
— ,[COGIPF_PROC_ID]
— [COGIPF_LOCALTIMESTAMP]
— ,[COGIPF_TIMEZONE_OFFSET]
count([COGIPF_SESSIONID])
— ,[COGIPF_REQUESTID]
— ,[COGIPF_STEPID]
— ,[COGIPF_SUBREQUESTID]
— ,[COGIPF_THREADID]
— ,[COGIPF_COMPONENTID]
— ,[COGIPF_BUILDNUMBER]
— ,[COGIPF_LOG_LEVEL]
— ,[COGIPF_STATUS]
— ,[COGIPF_ERRORDETAILS]
— ,[COGIPF_LOGON_OPERATION]
— ,[COGIPF_USERNAME]
,[COGIPF_USERID]
— ,[COGIPF_NAMESPACE]
FROM [MYAUDITDB].[dbo].[COGIPF_USERLOGON]
where [COGIPF_LOCALTIMESTAMP] between ’2009-01-01 10:00:00.000′ and ’2009-01-01 11:00:00.000′
and [COGIPF_LOGON_OPERATION] = ‘Logon’
– and [COGIPF_USERID] = ‘MYCOGNOSID’
group by [COGIPF_USERID]

And more refined by hourly usage

SELECT COUNT([COGIPF_PROC_ID]) as count
, datepart(hh,[COGIPF_LOCALTIMESTAMP]) as hr
,convert(char(10), [COGIPF_LOCALTIMESTAMP], 101) as dt
FROM [MYAUDITDB].[dbo].[COGIPF_USERLOGON]
where [COGIPF_LOCALTIMESTAMP] between ’2009-01-01 6:00:00.000′ and ’2009-01-01 15:00:00.000′
–and [COGIPF_LOGON_OPERATION] = ‘Logon’
group by convert(char(10), [COGIPF_LOCALTIMESTAMP], 101),datepart(hh,[COGIPF_LOCALTIMESTAMP])
order by dt, hr