Not sure if it helps but in my case, I have some stats that require me to look at combination of clients services, and the intersection (some clients are using some services, but not others). I needed to do some stats for distinct client, service, and the client-service contracts. My raw data already have the field of each transaction with name of the client and service they have. I can get that by creating a new field, CONTRACT, which is simply a concatenation of client and service, then I can do a distinct count on it:
| stats count by CLIENT SERVICE | eval CONTRACT = CLIENT . "-" . SERVICE | stats dc(SERVICE) dc(CLIENT) dc(CONTRACT)
... View more