Get last log event by username and eventtype

Hi all,

I have quite a lot of login events stored in loki and I’d like to get the last login event for every user. So basically a table with and .

Unfortunately I’m not sure how to approach this challenge - I tried something like this but it is not event close to what I am looking for.

count_over_time (
| logfmt 
| audit_event="login"
| line_format "{{.username}}"

Can anybody help please.

Thank you

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.