user activities are captured in _audit index. Using this i would like to see how many users are active on a given minute for an hour. I tried this
index=_audit | dedup user | timechart span = "1m" count(user)
but dedup worked on the whole time frame instead of every minute. Any help would be appreciated.