My data consists of individual messages, tagged with the userID of the user who sent them. I want to count the number of users who say "burger" and "fries", but not necessarily in the same message.
In the example
UserID
Message
1
"I'd like to order a burger"
2
"The weather is nice"
1
"I'd also like some fries"
2
"I'd only like a burger"
User 1 should be counted by user 2 shouldn't.
I believe a way to do this would be inner joining by the userID on two separate searches
index=idx_chatbot_gb_p component=chatbot-ms
| spath "userID"
| spath input=payload output=Message path=messages.message{}.plaintext
| search (Message=* burger *)
| join type=inner userID [ seach (Message=* fries *) ]
I get zero results when I try this, even though I get results on the individual searches and many users order burgers and fries.
Does anyone know a better way to do this or can spot what I've done wrong? Thanks
... View more