Looking for the count of events matching every eventtype combination.
For instance:
Given 5 events (e1..e5) that match eventtypes A and B as follows:
The count I'm looking for is:
EventTypes combination / count:
Seems to me you need to create a field that represents every combination of eventtypes, so:
... | eval comboeventtypes=mvjoin(eventtypes,";") | stats count by comboeventtypes