I tried this as well "Book bought by"
| rex field=_raw "Book\sbought\sby\sAccountId=(?P<Account>\d+),\sBookName=(?P<bookBoughtName>.*)"
| join type=left Account
[search "Book Sold By"
| rex field=_raw "Book\ssold\sbuy\sAccountId=(?P<Account>\d+),\sBookName=(?P<bookSoldName>.*)"]
| stats count(bookBoughtName) as "Bought" count(bookSoldName) as "Sold" by Account bookBoughtName but it's not working, giving the same old result. I issue I am getting is in the sold count not in the bought count. What's happening is. Suppose bought count is 3 for book1, if sold count for book1 is 0 than it shows 0. but if sold count is more than 0 (let say 1) than instead of showing 1 sold count is showing same as bought count i.e. 3 although it should show bought-3 sold-1 but showing bought-3 sold-3. In short sold count is either 0 or same as bought count that's the issue i am facing. Please help!
... View more