@sharonmok, what are the month and user fields in your query. How do you identify Login attempt? Do you need to count only successful login or failed one as well? Can this be identified based on your data?
If you can add sample data and current query that you have tried, it will help us assist you better.
This is what I had originally:
| dedup usercompany, datemonth
| stats count(usercompanyname) as clientcount
| eval A = (client_count /100) * 100
| table A
The last two lines were just to make it into a percentage out of the total number of users. Login attempt is just if they show up in the logs. No need to count the ones that didn't log in.
You need to give a alias name.
Try the below query..
| stats dc(Month) as Month,list(Month) as Months,values(Month) as Monthss by User
| where Month>=3
| table User Month Months Monthss