I would like to generate a graph that shows the daily unique visitors login based on their e-mail address.
If i logged in yesterday and today, my login should show yesterday and today.
Currently I am running the following search and that shows my login only once.
Below is the search string I am using:
"login *" sourcetype="*prod_logs" | rex field=_raw "login (?<email>.*)" | | dedup email | eval month_day=strftime(_time,"%2y/%2m/%2d") | chart count by month_day [Date Range: Month to date]
Any suggestion on how to graph the unique logins for each day and not unique for "Month to date"?
... View more