I have a search that counts the amount of times a user runs a program, and then returns the usernames of the users who run it more than threshold 'x_times'. The search requires information from two sourcetypes that have one 'event_id' in common.
index=blah (sourcetype=example_1 OR sourcetype=example_2) earliest=-1d@d
| stats values(username), values(type), values(program_name), values(hostname) by event_id
| search type=filter_1 program_name=filter_2
| eventstats count as user_count by username
| search user_count >= 5
| table username
My goal, is that after I have the usernames I'm interested in, I want to be able to run predictions on each username. I have tried this two ways:
Experimentation has shown me that the map search can't seem to process past the STATS or the JOIN. Without the STATS or the JOIN, and then only being able to use one filter, I can get it to work. But with them it fails, and I'm unable to get an accurate prediction.
Is there a solution, or do I need to approach this a different way?