Finding a intersect between n fields using multisearch

[cindygibbs_08]

Hello guys

I was thinking if it was possible to perhaps find the common and uncommon values between n fields after using a multisearch command, I cant seem to find a function in Splunk to yield the intersect between values, or is there one?

Lets say that my code looks like this:

|multisearch 
[|search index=BOOK
| fields A]
[|search index=FLIGHT
| fields B]
[|search index=HOTEL
| fields C]​

A,B and C are IDs from different custumers and I´d like to know what are the common costumers between the three fields and also the costumers that are exclusive to each field (that means that their ID only apprears in either field A, B or C )

-Please dont judge me 😞

I started by using the stats command and do something like
| stats values(A) as A values(B) as B and values(C) as C 
but since there is no other field to do something like " by clause" I was even able to have the info in a table, any information or documentation is so welcome thank you so much guys

kindly,

Cindy

[bowesmana · Accepted solution]

If I understand correctly, you want to get the types of bookings by customer id and identify where there are common bookings by the same customer or only single bookings.

So, the base search, assuming A, B and C represent the customer Id in the data from each index, is

index=BOOK OR index=flight OR index=hotel
| eval customerId=coalesce(A,B,C)
| stats dc(index) as types values(index) as indexes by customerId

You can then do

| where types=1

to find the customers with only one booking type and 

| where types=3

to identify all 3.

[cindygibbs_08]

thank so much!