Hi all, I need to show the number of concurrent logged users within the last 30 days. What I would like to have is a linechart showing for each day an overview with the most important spikes happened. So far I have implemented this query which works as expected but takes more than a minute to load entirely since it shows all the concurrent users for each minute of the day, for each day of the month. I don't need to see the status for each minute of the day, that's why I'm thinking about grouping data per day.
sourcetype=my_log source=/var/log/mylog.log | bucket _time span=1m | stats dc(cID) by _time | rename dc(cID) as concurrent_users
cID is the unique identifier string per user
