I currently have two sets of data where one includes all of the product views, and one includes all of the downloads on the webapp. Both reports generate a userId and I have them extracted as fields.
Ideally I would like to join another search where it looks up the items that were downloaded based on the userId. An example of the nature the data is in:
_
Company Name // UserId // Product Name // View Count
Company ABCD // 11111 // Product A // 2
Company EFGH // 22222 // Product A // 7
Company IJKLM // 33333 // Product B // 5
_
User Id // Document Id // Download Count
11111 // 88194432978 // 1
11111 // 36634432211 // 2
22222 // 12983769718 // 1
33333 // 51928379855 // 3
_
Below is the search I use to get the product access based on a client:
eventtype="advisorViewedProduct" | top productName by companyName, userId | stats list(*) as * by companyName, userId | table companyName,userId,productName,count
The following is the search I use to get the document downloads:
eventtype"documentDownloads" | top documentId by userId | stats list(*) as * by userId | table userId, documentId, count
Try this
eventtype="advisorViewedProduct" | top productName by companyName, userId | rename count as "View count"| append [search eventtype"documentDownloads" | top documentId by userId | rename count as "Download count" ]| stats values(*) as * by userId
| table companyName, userId productName "View count" documentId "Download count" | stats list(*) as * by companyName userId
Alternatively
eventtype="advisorViewedProduct" | top productName by companyName, userId | rename count as "View count"| append [search eventtype"documentDownloads" | top documentId by userId | rename count as "Download count" ] | eventstats values(companyName) as companyName by userId | stats list(*) as * by companyName userId | table companyName, userId productName "View count" documentId "Download count"
Try this
eventtype="advisorViewedProduct" | top productName by companyName, userId | rename count as "View count"| append [search eventtype"documentDownloads" | top documentId by userId | rename count as "Download count" ]| stats values(*) as * by userId
| table companyName, userId productName "View count" documentId "Download count" | stats list(*) as * by companyName userId
Alternatively
eventtype="advisorViewedProduct" | top productName by companyName, userId | rename count as "View count"| append [search eventtype"documentDownloads" | top documentId by userId | rename count as "Download count" ] | eventstats values(companyName) as companyName by userId | stats list(*) as * by companyName userId | table companyName, userId productName "View count" documentId "Download count"
Where are the download terms? Is that in a separate log?
It's all in the same log, just a different eventtype.