Assuming you need to split the events not only with ARTIST, but also PLAY_DATE,
You should do the latter first since you split the ARTIST field with mvexpand.
you just need to take off the mvexpand part.
it would be like
STATION_ID="S1" OR STATION_ID="S2"
| stats values(STATION_ID) as station by ARTIST, PLAY_DATE
| eval station = if (mvcount(station)==2, "shared", station)
| bin PLAY_DATE span=1d
| stats dc(ARTIST) as play_count by station, PLAY_DATE
to merge them would be difficult, since mvexpand breaks a field.
I don't have any great ideas, so I would just call appendcols or something for now.
(query1)
| appendcols [ (query2) ]
by the way, please verify this assumption.
if one play had ARTIST A;B at station1,
and another had ARTIST B;C at station2.
the two are not shared plays, but B is a shared artist. right?
... View more