no events for distinct logins into an app in the last 30 days

[anikeshp7]

Requirement- I want to display distinct logins into an app in the last 30 days.

My query returns zero events.

index="123" AND organizationId="011110012D" logRecordType=ailtn ("appName":"Cash_Platform" AND "appType":"Console") [|inputlookup "test"|table UserID|rename UserID as userId]|lookup test.csv UserID AS userId |timechart span=1mon dc(userId) as distinctLogins

Here App name is Cash_Platform and lookup file test.csv contains  UserID and UserNames

Any Suggestions where am I doing wrong or how this can be improved to return valid events.

Thanks

[anikeshp7]

yup. I also have a requirement where I want to show time spent by user on the console in above query. How should I achieve that ?

[ITWhisperer]

Have you worked out where you are losing events?

index="123" AND organizationId="011110012D" logRecordType=ailtn ("appName":"Cash_Platform" AND "appType":"Console")

By the way, AND is implied and it looks like you are checking JSON fields so you may need to escape the double quotes around the keys and values,  so try:

index="123" AND organizationId="011110012D" logRecordType=ailtn "\"appName\":\"Cash_Platform\"" "\"appType\":\"Console\""

 If this has your expected events, try:

index="123" AND organizationId="011110012D" logRecordType=ailtn ("appName":"Cash_Platform" AND "appType":"Console") [|inputlookup "test"|table UserID|rename UserID as userId]

If you are still getting events, try:

index="123" AND organizationId="011110012D" logRecordType=ailtn ("appName":"Cash_Platform" AND "appType":"Console") [|inputlookup "test"|table UserID|rename UserID as userId]|lookup test.csv UserID AS userId

[anikeshp7]

@ITWhispererI just simplified the query further to get unique logins in last 30 days

index="123" AND organizationId="011110012D" logRecordType=ailtn ("appName":"Cash_Platform" AND "appType":"Console") earliest=-30d | dedup userId | lookup test.csv UserID AS userId | stats count(userId)

This is returning the events . 

I welcome any suggestions for improvement

++Now Im trying to display time spent by user on the app console . Dont know how to write query for this.

[ITWhisperer]

Does index="123" AND organizationId="011110012D" logRecordType=ailtn ("appName":"Cash_Platform" AND "appType":"Console") userId=* return any events? Do any of the userIds match what you are expecting?

[anikeshp7]

Hi @ITWhisperer it does retuen events with userId=*

[ITWhisperer]

and do any of them match with the UserId in "test"?