First I search the number of login by sector for users with a mobile
mysearch | stats count as loginOK by sector
The result is like :
Secteur login
S1 25
S2 56
S3 12
My second search, in another log, counts the number of users passing through different authentication modules
mysearch2 | stats count by module sector2
The result is like :
Secteur module1 module2 module 3
s1 25 15 12
s2 56 51 42
s3 12 9 8
This second search pulls me the information of all mobile users or not.
But I only want the mobiles results
I can't join the 2 searches to count only kinematic of users with a mobile.
mysearch | stats count as loginOK by sector | join [search mysearch2 | stats count by module sector2 ] | lookup sector_sector2 sector output sector2 | table sector2 module1 module2 ...
