This example retrieves Usage data from the last day for computer names that contains the string "ContosoFile". The results are sorted by "TimeGenerated".
Usage
| where TimeGenerated > ago(1d)
| where Computer contains "ContosoFile"
| sort by TimeGenerated desc nulls last