topic Joining two eventtypes based on an ID in Splunk Search

Joining two eventtypes based on an ID

emamedov — Tue, 02 Aug 2016 22:13:50 GMT

I currently have two sets of data where one includes all of the product views, and one includes all of the downloads on the webapp. Both reports generate a userId and I have them extracted as fields.

Ideally I would like to join another search where it looks up the items that were downloaded based on the userId. An example of the nature the data is in:
_
Company Name // UserId // Product Name // View Count
Company ABCD // 11111 // Product A // 2
Company EFGH // 22222 // Product A // 7
Company IJKLM // 33333 // Product B // 5
_
User Id // Document Id // Download Count
11111 // 88194432978 // 1
11111 // 36634432211 // 2
22222 // 12983769718 // 1
33333 // 51928379855 // 3
_
Below is the search I use to get the product access based on a client:

eventtype="advisorViewedProduct" | top productName by companyName, userId | stats list(*) as * by companyName, userId | table companyName,userId,productName,count

The following is the search I use to get the document downloads:

eventtype"documentDownloads" | top documentId by userId | stats list(*) as * by userId | table userId, documentId, count

Re: Joining two eventtypes based on an ID

sundareshr — Tue, 02 Aug 2016 22:33:31 GMT

Where are the download terms? Is that in a separate log?

Re: Joining two eventtypes based on an ID

somesoni2 — Tue, 02 Aug 2016 22:34:19 GMT

Try this

eventtype="advisorViewedProduct" | top productName by companyName, userId  | rename count as "View count"| append [search eventtype"documentDownloads" | top documentId by userId  | rename count as "Download count" ]| stats values(*) as * by userId
| table companyName, userId productName "View count" documentId "Download count" | stats list(*) as * by companyName userId

Alternatively

eventtype="advisorViewedProduct" | top productName by companyName, userId  | rename count as "View count"| append [search eventtype"documentDownloads" | top documentId by userId  | rename count as "Download count" ] | eventstats values(companyName) as companyName by userId | stats list(*) as * by companyName userId  | table companyName, userId productName "View count" documentId "Download count"

Re: Joining two eventtypes based on an ID

emamedov — Tue, 02 Aug 2016 23:34:42 GMT

It's all in the same log, just a different eventtype.