Linechart with clustered data

[paxo]

Hi all, I need to show the number of concurrent logged users within the last 30 days. What I would like to have is a linechart showing for each day an overview with the most important spikes happened. So far I have implemented this query which works as expected but takes more than a minute to load entirely since it shows all the concurrent users for each minute of the day, for each day of the month. I don't need to see the status for each minute of the day, that's why I'm thinking about grouping data per day.

sourcetype=my_log source=/var/log/mylog.log | bucket _time span=1m | stats dc(cID) by _time | rename dc(cID) as concurrent_users

cID is the unique identifier string per user

[richgalloway]

I agree that minute granularity is too fine for a 30-day window. Change "span=1m" to "span=1d" to get days. Consider "span=8h" if you want to see spikes during a day.