How would i report for a year if on a montly basis user x logged in once or more then once.
the table shall look like this:
singe login multiple logins
January 5 1
February 20 9
...
So far i rather clumsily build up an aproximate result like this:
| stats count(CN) by date_month,CN
| rename count(CN) AS freq
| eval frequency=if(freq>1,"multiple logins","single login")
| stats count(CN) by frequency,date_month
You're actually really close. You want to use a chart command last to turn your results into the table you want.
| stats count as freq by date_month,CN
| eval frequency=if(...)
| chart count over date_month by frequency
You're actually really close. You want to use a chart command last to turn your results into the table you want.
| stats count as freq by date_month,CN
| eval frequency=if(...)
| chart count over date_month by frequency
I could have the over and by clause reversed, (being on an iPad in the airport this is a bit off the top of my head) the contents of the if function are the same as yours, also I used an as clause to get rid of the rename clause.
Thanks. Simple as that huh? Oh well.