VMware ESXi - Multiple VMs stopped

Original query, unchanged.

let threshold = 5;
VMwareESXi
| where SyslogMessage has ('VmPoweredOffEvent')
| extend SrcUsername = extract(@'\[info\]\s+\[(.*?)\]', 1, SyslogMessage)
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| summarize st_vm = make_set(DstHostname,200) by SrcUsername, bin(TimeGenerated, 5m)
| where array_length(st_vm) > threshold
| extend hostname = iff(array_length(st_vm) > 0, st_vm[0], "")
| extend NTDomain = tostring(split(hostname, '\\', 0)[0]), Name = tostring(split(SrcUsername, '\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0]), DnsDomain = tostring(split(SrcUsername, '\\', 1)[0])