Correct! I was obliterating _time. Built-in time functions, report back 8 days in a week, probably b/c of timezones. latest(_time) didn't work over multiple weeks, the below query while not pretty does the job.
... | eval WorkWeek=strftime(_time, "%U")| eval my_day=strftime(_time, "%d") | eval Day_ID = my_day+";"+WorkWeek+";"+UserID | stats dc(Day_ID) AS DaysConnected by WorkWeek, UserID | stats count(eval(DaysConnected<=3)) AS OccasionalUsers count(eval(DaysConnected>3)) AS FrequentUsers by WorkWeek | eval UserLoyalty = FrequentUsers*100/(FrequentUsers+OccasionalUsers)
... View more