Goal - I am searching for "number of actions per unique customer" metrics from API metric logs. below is my query. Below query is filtering results by providing specific request.path and then getting stats by Customer_Id and _time. and then getting the total count as uniqueCustomers and sum up those counts so that it will get the totalActions and the res is actually diving totalActions/uniqueCustomers index="some_index" sourcetype="api-index" message="Metrics Information" | rex field=request.path "/v1/actions-api/(?<Customer_Id>\w+)" | stats count by Customer_Id, _time | eventstats count as uniqueCustomers | eventstats sum(count) as totalActions | eval result = totalActions/uniqueCustomers The problem is that I don't know how to count these result per day. I tried below but isn't working because it has two BY clauses. Please suggest some solutions. Thank you | bin _time span=1d
... View more