Get last log event by username and eventtype

Hi all,

I have quite a lot of login events stored in loki and I’d like to get the last login event for every user. So basically a table with and .

Unfortunately I’m not sure how to approach this challenge - I tried something like this but it is not event close to what I am looking for.

count_over_time (
{source="ksyslog"} 
| logfmt 
| audit_event="login"
| line_format "{{.username}}"
[100h])

Can anybody help please.

Thank you