Thanks, that got me there.
For others (and future me), what I did was:
I used kubectl to query mongodb. My query returned a list of usernames and lastupdated datetimes. I think lastupdated here refers to the last time the user did something like loading a page or updating a dashboard; you might like to experiment exactly what causes lastupdated to update.
1. kubectl -n sisense get pods
Make a note of the "sisense-mongodb-*" pod's name.
2. kubectl -n sisense exec -it sisense-mongodb-<name you got in 1> -c mongodb -- mongo prismWebDB --quiet --eval 'db.getCollection("socket-sessions").find({"registrationDetails.headers.authentication.isAuthenticated": true }, {_id: 0, "registrationDetails.user.userName": 1, "registrationDetails.user.tenant.name": 1, "registrationDetails.user.lastUpdated": 1}).toArray();'
3 (Optional). You get a JSON array representing lots of sessions. I parsed and aggregated it to get the latest lastUpdated datetime for each user. You might like to also filter to where lastUpdated is in the last 24hr.
