How to edit my timechart search to find the top 5 users who get disconnected from our application on a monthly basis?

[mishradb]

I would like to view the top 5 users who get disconnected from our application on a monthly basis. I ran the search below from Jan 15 to Jun 15:

index=client sourcetype=client-logs "channel connect failed" channel=* date_month!=NULL  | timechart count by guid where max in top5.

However, if i run the search above for just 1 month, the top 5 users returned is different from what i get when i run it for 6 months.
Considering the fact that, the top 5 users could vary on a monthly basis, what is the best way of achieving this?

[woodcock]

Beware the use of the date_* fields, they are not always correct (ask me why if you really would like the gory details). Try this:

index=client sourcetype=client-logs "channel connect failed" channel=* | timechart span=1m count BY guid | top 5 count BY guid,_time

[aweitzman]

You should be able to just use top for this:

... | top 5 guid by date_month