I have many events, but only want to select those that have the same docId in order to compare the Durations of 2 different viewers.
Sample Data:
Viewer=viewer1, docId=12345, Duration=1204
Viewer=viewer2, docId=12345, Duration=998
Viewer=viewer1, docId=42543, Duration=1411
Viewer=viewer1, docId=98322, Duration=1502
Viewer=viewer2, docId=77777, Duration=1256
....
Expected Output (only get docId, durations that has been viewed by both viewer1 and viewer2, e.g. docId=12345):
docId, Viewer1_Duration, Viewer2_Duration
12345, 1204, 998
To join the data, you just need to use a join
<base search> Viewer=viewer1 | join docId [search <base search> Viewer=viewer2]
This should get you the join. If you want the two durations distinguished though, you should rename
the duration fields to something else before the join
<base search> Viewer=viewer1 | rename Duration AS Viewer1_Duration | join docId [search <base search> Viewer=viewer2 | rename Duration AS Viewer2_Duration ]
Hope this helps