My log contains below entries:
activated=true productid=8432 userid=123 email@example.com activated=false productid=8432 userid=2123 firstname.lastname@example.org activated=true productid=3422 userid=434123 email@example.com activated=true productid=433232 userid=7468 firstname.lastname@example.org
I want to find the count for all those users who have activated=true and whose productids are not 645,423,433232,7483,57893,45673,847832,48832,4323,432,3323,323,12,233,234545,2323
Can any one provide me the query for the same?
use lookup tables , list the product id you're looking for in csv and add a seen field to it:
and so on
then run the search
activated=true | lookup yourlookuptable productid OUTPUT seen | Where seen!=1
you can read more on lookup tables at:
if you look at gooza's answer, you can do it with a lookup table. it's actually better (much better) with a subsearch and a lookup definedd like he has, and then doing:
activated=true NOT [ inputlookup yourlookuptable | return 10000 productid ] | stats count
which will work with up to 10000 productids.