Hello my dear splunkers I hope you are doing very well.. I would REALLY be so thankful if u can help me put with the following.... Im trying to create a table where the rows are the results from count of some values that I need.. first I will have to search in 3 differentent indexes and then I will have to create this table: fields common to all = ID. the other field is type or product bought A B or C I need to put in a table by month of year the total amount of IDS that bought only product A, and the total amount of product that bought A & B (that means they did not buy C at all) and the total IDS that bought (B & C ) meaning they didnt buy any A at all and finally the IDS that didnot buy anything at all this is the data I'm working with | multisearch [|search index="products_sold" AND productId=A AND ID_INFO=* | IDA=ID_INFO] [|search index="products_sold" AND productId=B AND ID_INFO=* | IDB=ID_INFO] [|search index="products_sold" AND productId=C AND ID_INFO=* | IDC=ID_INFO] | fields IDA IDB IDC # IDA are the people who bought product A, IDB bought product B , IDC bought product C let's say that for yesterday I have the following IDA= 11, 10,12, 78, 89,13 IDB= 11, 10, 45,13 IDC= 11, 10, 25 I want to be able to get this table : Category Total IDS Only A 3 Only B 1 only C 1 A & B 3 B & C 2 C & A 2 A, B, C 2 Only A = 3 because the IDS (12, 78, 89) only bought during that time product A A,B,C = 2 because the IDS (10,11) boought produts A B and C during this time I hope this can ilustrate what I am trying to achive and I can not stress enough how much you guy's help means to me THANK YOU SO SO MUCH to anyone that can help me
