|multisearch
[|search index=BOOK
| fields A]
[|search index=FLIGHT
| fields B]
[|search index=HOTEL
| fields C]
A,B and C are IDs from different custumers and I´d like to know what are the common costumers between the three fields and also the costumers that are exclusive to each field (that means that their ID only apprears in either field A, B or C )
-Please dont judge me 😞
If I understand correctly, you want to get the types of bookings by customer id and identify where there are common bookings by the same customer or only single bookings.
So, the base search, assuming A, B and C represent the customer Id in the data from each index, is
index=BOOK OR index=flight OR index=hotel
| eval customerId=coalesce(A,B,C)
| stats dc(index) as types values(index) as indexes by customerId
You can then do
| where types=1
to find the customers with only one booking type and
| where types=3
to identify all 3.
If I understand correctly, you want to get the types of bookings by customer id and identify where there are common bookings by the same customer or only single bookings.
So, the base search, assuming A, B and C represent the customer Id in the data from each index, is
index=BOOK OR index=flight OR index=hotel
| eval customerId=coalesce(A,B,C)
| stats dc(index) as types values(index) as indexes by customerId
You can then do
| where types=1
to find the customers with only one booking type and
| where types=3
to identify all 3.
thank so much!