Splunk Search

How to create a table where the rows are results from previous field operation about common and uncommon values

andres91302
Communicator
Hello my dear splunkers I hope you are doing very well.. I would REALLY be so thankful if u can help me put with the following.... Im trying to create a table where the rows are the results from count of some values that I need.. first I will have to search in 3 differentent indexes and then I will have to create this table: fields common to all = ID. the other field is type or product bought A B or C I need to put in a table by month of year the total amount of IDS that bought only product A, and the total amount of product that bought A & B (that means they did not buy C at all) and the total IDS that bought (B & C ) meaning they didnt buy any A at all and finally the IDS that didnot buy anything at all this is the data I'm working with | multisearch [|search index="products_sold" AND productId=A AND ID_INFO=* | IDA=ID_INFO] [|search index="products_sold" AND productId=B AND ID_INFO=* | IDB=ID_INFO] [|search index="products_sold" AND productId=C AND ID_INFO=* | IDC=ID_INFO] | fields IDA IDB IDC # IDA are the people who bought product A, IDB bought product B , IDC bought product C let's say that for yesterday I have the following IDA= 11, 10,12, 78, 89,13 IDB= 11, 10, 45,13 IDC= 11, 10, 25 I want to be able to get this table : Category Total IDS Only A 3 Only B 1 only C 1 A & B 3 B & C 2 C & A 2 A, B, C 2 Only A = 3 because the IDS (12, 78, 89) only bought during that time product A A,B,C = 2 because the IDS (10,11) boought produts A B and C during this time I hope this can ilustrate what I am trying to achive and I can not stress enough how much you guy's help means to me THANK YOU SO SO MUCH to anyone that can help me
Labels (1)
0 Karma

andres91302
Communicator
Category Total IDS Only A 3 Only B 1 only C 1 A & B 3 B & C 2 C & A 2 A, B, C 2
0 Karma

andres91302
Communicator
sorry guys... this is the table Category Total IDS Only A 3 Only B 1 only C 1 A & B 3 B & C 2 C & A 2 A, B, C 2
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...