I'm working with a audit trail data and trying to make a graph (or even a table) that would list users that have a greatest drop on usage since last month.
So far I have tried the following.
TSVB:
I can get a percentage difference of activity level per user per month. But I cannot order the results based on these values.
Lens:
I can get percentage of difference of activity per month but I cannot split the result based on terms at all.
Continuous transform index
I created a transform index that has a monthly record per user with a record count from the audit trail. However, I cannot include derivate or serial difference aggregations on a transform.
Am I missing something or what should I try next? I cannot cope how difficult this kind of visualization is to create. Without proper ordering possibilities all of the above solutions are useless.
