I am creating a search that finds ID's in two different logs, one when the ID is created and another when the ID is submitted. I only want to find IDs that were created and then adandoned, so I wrote the following search to extract IDs and only extract un-submitted ones.
| multisearch
[ search index=ff ...
| rex field=_raw "^[^{]*(?P<my_data>.+)"
| spath input=my_data output=cart_id path=cartId
| eval type="search1"]
[ search index=ff "slotSubmitOrderByCartId() - Input Parameters"
| rex field=_raw "Input\sparameters:\s(?<cart_id>.+)\s,\s{" ]
| table cart_id
| stats count by cart_id
| search count=1
The issue is that if a cart was submitted long enough past its created time, then it will only appear once in the logs and be included in the list of IDs with a single event. Is there a way to find only logs that appear in created calls? I would like to avoid using a lookup if possible.
