Need to list how many users who have disconnected 10 or more times per time selected

[Madmax]

I can get total disconnects but can't seem to find a way to get total of how may users who disconnected 10 or more times.  

Here is my search: 

 index=gbts-vconnection sourcetype=VMWareVDM_debug "onEvent: DISCONNECTED" (host=host2) OR host=Host1) earliest=$time_tok.earliest$ latest=$time_tok.latest$
| rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds 

| rename IONS as "User ID" Device as "User Device"
| convert timeformat="%m-%d-%Y" ctime(_time) AS date
|timechart span=1d limit=0 , count

[Madmax · Accepted solution]

I found the solution and wanted to post it here.  I added Device name which then allowed me to use IONS (User ID), to get the total count.  My new challenge is to get these stats on a per day basis in a line chart.  Perhaps someone can give me some ideas. 

| stats count by Device IONS
| where count >= 10
| appendpipe [|stats count as IONS | eval Device="Total"]

[Madmax]

I also played around with the addcoltotals command but that only gives me the totals of the count.  I need the total of "User ID" 

[richgalloway]

The stats command can count the number of disconnects for each user.  Then filter out users with fewer than ten disconnects.

 index=gbts-vconnection sourcetype=VMWareVDM_debug "onEvent: DISCONNECTED" (host=host2) OR host=Host1) earliest=$time_tok.earliest$ latest=$time_tok.latest$
| rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds 
| stats count by IONS
| where count >= 10
| rename IONS as "User ID" 

[Madmax]

That lists all USer IDs that have over 10 disconnects.  I need the total number of users that have disconnected in that time frame.  I essentially need to add the number of USER IDs that have over 10. Just one number. 

[richgalloway]

To get a total number of users, use the stats command again.

...
| stats count by IONS
| where count >= 10
``` So far we have one result per user.  Count the number of results to get the number of users. ```
| stats count as IONS
| rename IONS as "User IDs"

[isoutamo]

How about add 'by "User ID"' to the end of timechart?

[Madmax]

I tried that but it gives a blank box.  No data.