I would like to know the number of users per application version over a period of time.
The events always include the application version and the user id but a user could have used different application versions over a period of time and I am interested on the latest, which happen to be the latest event for a given user, so how can I restrict a query to search only through the last events per user?, below it is my attempt which is not working..
search |stats values(email) as email, values(deviceSerial) as deviceSer, values(appVersion) as appVersion, latest(_time) AS latest_time by deviceSerial |fields email deviceSer appVersion latest_time| dedup email latest_time| stats dc(email) as users by appVersion | sort -users
... View more