ParseLatestEWSLogsForResolveNames.ps1

# Note that this assumes we're running from the folder with the EWS logs in it.
# Choose the most recent 50 logs
Get-ChildItem *.log | Sort-Object LastWriteTime -Descending | Select-Object -First 50 | ForEach-Object { Import-Csv $_ } | Where-Object { $_.SoapAction -like "Resolve*"} | ForEach-Object {
    # Produce a new object that only has the fields we care about
    # One important part of this is we are converting the time and request times from strings into sortable values
    [PSCustomObject]@{
        DateTime = [DateTime]::Parse($_.DateTime)
        ClientIpAddress = $_.ClientIpAddress
        AuthenticatedUser = $_.AuthenticatedUser
        UserAgent = $_.UserAgent
        SoapAction = $_.SoapAction
        TotalRequestTime = [int]::Parse($_.TotalRequestTime)
    }
} | Sort-Object TotalRequestTime -Descending | Export-Csv $home\desktop\ResolveNames.csv -NoTypeInformation

To produce the aggregate values:

$totalRequestTime = @{}
Import-Csv $home\desktop\ResolveNames.csv | % { $totalRequestTime[$_.AuthenticatedUser] += [int]::Parse($_.TotalRequestTime) }
$totalRequestTime.GetEnumerator() | Sort Value -Descending | Select -First 20 | ft -a

To aggregate many files together:

$totalRequestTime = @{}
Get-ChildItem *.csv | % {
    foreach ($line in (Import-Csv $_)) {
        $totalRequestTime[$line.AuthenticatedUser] += [int]::Parse($line.TotalRequestTime)
    } 
}
$totalRequestTime.GetEnumerator() | Sort Value -Descending | Select -First 100 | ft -a