I'm using this code which gives me the information but I need current total users
(index=* OR index=_*) (index=* OR index=_*) index=wineventlog "ComputerName=sample_server" "EventCode=4624" | fields "_time", "user" | dedup "user"
(JFI -- I USED 15 MIN TIME FRAME)
... View more