Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Joining two eventtypes based on an ID

$
0
0
I currently have two sets of data where one includes all of the product views, and one includes all of the downloads on the webapp. Both reports generate a userId and I have them extracted as fields. Ideally I would like to join another search where it looks up the items that were downloaded based on the userId. An example of the nature the data is in: _ Company Name // UserId // Product Name // View Count Company ABCD // 11111 // Product A // 2 Company EFGH // 22222 // Product A // 7 Company IJKLM // 33333 // Product B // 5 _ User Id // Document Id // Download Count 11111 // 88194432978 // 1 11111 // 36634432211 // 2 22222 // 12983769718 // 1 33333 // 51928379855 // 3 _ Below is the search I use to get the product access based on a client: eventtype="advisorViewedProduct" | top productName by companyName, userId | stats list(*) as * by companyName, userId | table companyName,userId,productName,count The following is the search I use to get the document downloads: eventtype"documentDownloads" | top documentId by userId | stats list(*) as * by userId | table userId, documentId, count

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>