context: I want to know how many accounts are on devices by day. In other words, if I can count dc(accountid) as accountid_per_device_count by deviceid, then I want to know how many of each accountid_per_device_count values per day. (eg 100 devices only have one accountid access per day, 200 have two accountid accesses per day, etc).
I know how to get the initial data by day using timechart:
basic search to get accounid,deviceid events | timechart span=1 dc(accountid) by deviceid
but I want to count the counts so to speak, per day.
↧