My data consists of login events to a system. Each user belongs to a Company, of which there are 12 companies represented. The event date is the login time.
Fields are
Company - Company code
Co_Name - Company name
Name - User's name
I want a report to show :
For each company, the users with the most logged in days, i.e. only one login counts per day, during a given period.
I can achieve the top user per company like this
sourcetype=logins* | stats dc(Date) as Count by Name, Co_Name | sort Co_Name, -Count | dedup Co_Name
but if there is a company with more than one user with the same number of logged in days, I will only get one, whereas I want all the users for that company with that max login count.
I tried this one
sourcetype=logins* | top showperc=false 1 Name, Company by Co_Name
but that does not take account of more than one login per day, which should only count 1.
I feel there would be a more correct way to achieve this other than my search string above...
... View more
