transaction query

[srajanbabu]

I have a search as source="C:\\Data\\acctdata\\snm4-logger.log" | transaction FILENAME_FIELD keepevicted=true| where mvcount(BYTES_FIELD)>1 | table FILENAME_FIELD BYTES_FIELD
producing filename and bytes transferred in each file.
Also i have a search as source="C:\\Data\\acctdata\\snm4-logger.log" | transaction Plainuserip keepevicted=true| where mvcount(FILENAME_FIELD)>1 | table Plainuserip FILENAME_FIELD
producing username and files transferred by each user.
I want to combine the the above two searches to produce the result as follows

Plainuserip FILENAME_FIELD BYTES_FIELD
1 EMBT01UK file corpfile5430695 148 bytes transferred
148 bytes transferredSSNM5

[alacercogitatus]

source="C:\\Data\\actdata\\snm4-logger.log" | transaction Plainuserip FILENAME_FIELD keepevicted = true | stats values(BYTES_FIELD) by Plainuserip FILENAME_FIELD

Might get you close to what you want.