I am trying to get a table showing the number of days a user was active in the given time period. I currently have a working search that gives me the number of total logins for each user and one that gives me the number of unique users per day. I am looking for "unique days per user".
ie. if Dave logs in 5x Monday, 3x Tuesday , 0x Wednesday, 2x Thursday, & 0x Friday I want to show 3 active days not 10 logins
Can you share the current query?
the query is:
index=main host=[hostname] Operation="UserLogon" ApplicationId=[appid]
If I add:
| timechart span=1d dc(UserId)
I get Unique users per day
OR I can run with:
| stats count by UserId
to get total logins per user for the period
I am looking to get "unique days per user"
See if this helps.
index=main host=[hostname] Operation="UserLogon" ApplicationId=[appid]
| bin span=1d _time
| stats dc(_time) as numDays by UserId
That did it, thanks for the assist.