My purpose is to count currently logged in user for a web site
Easiest way to get this is something like | stats dc(cs_username)
However, that really does not reflect true numbers that I am after as there could be one username logged in from different client machines simultaneously. Also, it is possible that users from outside agency can log on to the web site (through our load balancer that rewrite client IP as its own IP) and if the external agency uses proxy, it will only report one client IP anyway.
Somehow, I don't see cs_cookie in the extracted field, which could have been helpful.
Any idea what is the best way to approach this?