We are using the Juniper SA app, however I am trying to create a dashboard that will show a chart of unique VPN users by role. So far I have created a search that gives me the total count of users by role, but the users counts are clearly not unique users.
This is the search I currently have:
index=vpn sourcetype=juniper_sa_log | chart count dc(users) by roles
Any suggestions on how to show the count of unique users by role?
How about just using "chart dc (usets) by roles" ?
That did it! Thanks for your help