Hi,
I'd like to draw a quick chart of unique instances of a given field over time. Specifically, I'd like a chart with:
x-axis: time in increments of days or hours
y-axis: number of unique users as defined by the field 'userid'
So regardless of how many userids appear on a given day, the chart would only display a single line with the number of unique userids.
I tried the following query, but it does not provide the above:
* | timechart count by unique(userid)
A sample log event would be:
event userid=X
... View more