Find the trend of logged in users by sifting through nginx logs in grafana

I have in grafana logs of loki which are pushed via fluentbit.

I want to see visualisation such that I see #active users at an hourly interval. My first attempt at it is in loki query like so:

count(sum by (log_http_headers_authorization) (count_over_time({container="/nginx", hostname="whirlpool-prod"} | json [1m])))

where authorization is a headers containing hashed “Authorization token” (its hashed so no security issues). Each token corresponds to a unique login. All the APIs from a logged in user’s session will have the same authorization value.

The issue with above query is that output from sum by subquery returns >500 series (for 3 hour duration):

maximum of series (500) reached for a single query

I’m inclined to believe this has to be not such a complex thing that cannot be solved inside grafana (and without hitting the 500 series limit). Essentially if there’s any other way to achieve it, that is totally acceptable.