I would like to view the top 5 users who get disconnected from our application on a monthly basis. I ran the search below from Jan 15 to Jun 15:
index=client sourcetype=client-logs "channel connect failed" channel=* date_month!=NULL | timechart count by guid where max in top5.
However, if i run the search above for just 1 month, the top 5 users returned is different from what i get when i run it for 6 months.
Considering the fact that, the top 5 users could vary on a monthly basis, what is the best way of achieving this?
... View more