How to build a table to where the rows are results from previous field operation about common and uncommon values

[andres91302]

Hello my dear splunkers I hope you are doing very well.. I would REALLY be so thankful if u can help me put with the following.... Im trying to create a table where the rows are the results from count of some values that I need.. first I will have to search in 3 differentent indexes and then I will have to create this table: fields common to all = ID. the other field is type or product bought A B or C I need to put in a table by month of year the total amount of IDS that bought only product A, and the total amount of product that bought A & B (that means they did not buy C at all) and the total IDS that bought (B & C ) meaning they didnt buy any A at all and finally the IDS that didnot buy anything at all like this: Category ids total Only A 58 (A & B) 15 Nothing at all 254 THANK YOU SO SO MUCH I TRULLY REALLY MEAN IT

[ITWhisperer]

Splunk is a tool that works really well with data. Please can you provide some real sample data and perhaps the queries you have so far?

[andres91302]

Hello! thank you so much for trying to help me out I am truly greateful for that.. this is the data I'm working with

| multisearch
[|search index="products_sold" AND productId=A AND ID_INFO=* | IDA=ID_INFO]
[|search index="products_sold" AND productId=B AND ID_INFO=* | IDB=ID_INFO]
[|search index="products_sold" AND productId=C  AND ID_INFO=* | IDC=ID_INFO]
| fields IDA IDB IDC
# IDA are the people who bought product A, IDB bought product B , IDC bought product C 
let's say that for yesterday I have the following

IDA= 11, 10,12, 78, 89,13
IDB= 11, 10, 45,13
IDC= 11, 10, 25

I want to be able to get this table :

Category	Total IDS
Only A	3
Only B	1
only C	1
A & B	3
B & C	2
C & A	2
A, B, C	2

Only A = 3 because the IDS (12, 78, 89) only bought during that time product A
A,B,C = 2 because the IDS (10,11) boought produts A B and C during this time

I hope  this can ilustrate what I am trying to achive and I can not stress enough how much you guy's help means to me THANK YOU SO SO MUCH to anyone that can help me

[ITWhisperer]

| multisearch
[|search index="products_sold" AND productId=A AND ID_INFO=*]
[|search index="products_sold" AND productId=B AND ID_INFO=*]
[|search index="products_sold" AND productId=C AND ID_INFO=*]
| stats values(productId) as Category by ID_INFO
| eval Category=mvjoin(Category,",")
| stats count as "Total IDS" by Category