This should work
... | bucket span=1d
| stats sum(xyz) AS values BY _time, user | sort -_time -values | dedup 10 _time
This should work
... | bucket span=1d
| stats sum(xyz) AS values BY _time, user | sort -_time -values | dedup 10 _time
This works fine, thanks a lot!