How to search the top 5 distinct users per day in the last 7 days?

[spin691t]

Hello Everyone
I'm a new user.
I would like to search the top 5 user logfail distinct by day in the last 7 days.
I wrote the search below, but I receive the top 5 users in the 7 days (one table with 5 rows), but not distinct per day (one table with 35 rows).
Could you help me?
Thank you in advance

|tag="WINDOWS" (Logon_Type="2" OR Logon_Type="3" OR Logon_Type="7" OR Logon_Type="10") tag=LOGFAIL | eval User_Name=mvindex(User_Name, -1) | eval User_lower=lower(User_Name) | eval Event_day=strftime(_time, "%Y-%m-%d" )| top 5 Event_day User_Name | sort -Event_day

[markthompson]

To get the distinct values,
you can use the dedup functionality,

| dedup User_name

You could also look at the timewrap function, https://apps.splunk.com/app/1645/

This allows you to view on a daily/weekly basis

Hope this helps 🙂

[pradeepkumarg · Accepted solution]

See if this works

|tag="WINDOWS" (Logon_Type="2" OR Logon_Type="3" OR Logon_Type="7" OR Logon_Type="10") tag=LOGFAIL | eval User_Name=mvindex(User_Name, -1) | eval User_lower=lower(User_Name) | eval Event_day=strftime(_time, "%Y-%m-%d" )|stats count by Event_day User_Name | sort -Event_day, -count | dedup 5 Event_day

[spin691t]

Hello
now I would like in visualization one stack with the 5 user per day but at the moment I have 5 stack with a single userid per day(35 single stack). I've selected "stack" in the visualization panel but doesn't work.
What I've to do?