I have an event which contains user id, and two more events which contains user id (same), transaction id (different). I want combine first event and second event as one event and first event and third event as one event. I should get only get two events. How do I do this?
Seeing an example of a set of three events would help, but if I understand correctly, then that this might work.
yourQueryThatPullsOnlyTheDesiredEvents | stats values(_raw) AS _raw BY userId transactionId
This will give you
userA txnA _raw
userA txnB _raw
I want to combine first ,
event1 user id a
event2 user id b
event3 user id a trans id p
event4 user id a trans id q
event3 user id b trans id p
event4 user id b trans id q
output should combine
event1 user id a
event3 user id a trans id p
as one event
event1 user id a
event3 user id a trans id q
as one event
event1 user id b
event3 user id b trans id p
as one event
event1 user id b
event3 user id b trans id q
What is your end goal (what type of report/aggregation you want to do after combining)? Also, can we have some sample logs and expected output format?