How all,
i used the search but could not get to an solution what i want.
I want to count how many unique users logged in in the last 24 hours.
I don’t want to count how many logins i had, only unique users.
I created the following Query:
count(
sum by (Username) (
count_over_time(
{service_name=~"^[A-Za-z]{3}[abasd][cbasd]0[0-9]{2}.*"}
|= "Host1"
|= "App1"
| pattern "<_>1234.Username=<Username>,"
| pattern "<_>Common.Text=<text>,"
| text=~"test.*"
[$__range]
)
)
)
This Query works fine if i set the time range to 1hour but if i want to go higher, i get into a Loki timeout.
Is there any way i can optimize that or get it working?