Hi,
I want to get a report using the dashboards for a time period exceeding 92 days that is currently permitted for stats dashboards.
i cant do this using a UDM search result since the requirement i have is to only get the latest login which is not possible through the CSV file that i can get by doing a udm search.
The query i need is this:
events:
$e.metadata.log_type = <logtypevalue>
$e.metadata.product_log_id = <value>
$e.principal.user.userid = $userid
$userid != ""
$e.principal.user.group_identifiers = $group
$seconds = $e.metadata.event_timestamp.seconds
$date = timestamp.get_date($e.metadata.event_timestamp.seconds)
match:
$userid, $group
outcome:
$event_count = count($e.metadata.id)
$Last_login_date = timestamp.get_timestamp(max($e.metadata.event_timestamp.seconds) + 19800) //adding +5.30 in minutes to utc time
order:
$userid asc
Is there a way i can do this.
