Sean Wei says to YSITD
read i; cat log |tr -d '\000' |grep 'User' |grep offline |grep -i $i |grep -oP '\d\d \K\d\d(?=:\d\d:\d\d\]\))' |sort -n |uniq -c |sort -nr |head