I'm trying to determine what hours over 7 days our ftp server has the lowest activity, or when no one is logged in.
Logging is captured by session, example below.
I'd like to produce a graph if possible that shows last 7 days number of active users over 1 hour timespan.
2018-01-31 06:28:39 110.10.10.10 - someuser [181000]quit - - 221 - - - 22
2018-01-31 06:28:39 110.10.10.10 - someuser [181000]kick - - 421 - - - 22
2018-01-31 06:28:39 110.10.10.10 - someuser [181000]ssh_disconnect timeout - 421 - - - 22
create bins of one hours and distinct count the users - you can show this in table or bar/column graph
index=yourindex | bin span=1h _time | stats distinct_count(Username) as active_users by _time
Something like
index=foo sourcetype=bar ssh | stats count by date_hour