Dataset Advice

[Ram_Dwarf]

I have been tasked to report the high marks of connected VPN users. Example if on Monday I have 10 connected users at 11:00, 100 connected users at 12:00 then 50 connected users at 1:00 I want the report to say 100, as that was the highest point for the day. (it would need to go 7 days back and check hourly.) Any assistance on making a data set that will pull this information would be appreciated.

[Ram_Dwarf]

This seems to get me what I am looking for,  When I do a test it comes up with the appropriate data.  But; when I create a chart and a report I only get the response of "No matching log data for this report"  What am I doing wrong???

SELECT $flex_datetime(timestamp) AS hodex,        count(DISTINCT `user`) FROM (                                    SELECT   $flex_timestamp AS timestamp,`user`                  FROM     $log                  WHERE $filter                  AND (tunneltype = 'ssl-tunnel'                  OR ( tunneltype like'ipsec%')                  OR tunneltype = 'ssl-web')                  AND `user` != 'N/A'                  GROUP BY timestamp,`user`)### t GROUP BY hodex order by hodex