Ordering results based on derivate aggregation

I'm working with a audit trail data and trying to make a graph (or even a table) that would list users that have a greatest drop on usage since last month.
So far I have tried the following.
I can get a percentage difference of activity level per user per month. But I cannot order the results based on these values.
I can get percentage of difference of activity per month but I cannot split the result based on terms at all.
Continuous transform index
I created a transform index that has a monthly record per user with a record count from the audit trail. However, I cannot include derivate or serial difference aggregations on a transform.

Am I missing something or what should I try next? I cannot cope how difficult this kind of visualization is to create. Without proper ordering possibilities all of the above solutions are useless.

Hey there, did you find your solution? Could you paste a visual that you want achieve? In Lens, you have the option to split the result by terms but I am not sure if this is what you mean:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.