index=itam sourcetype=itam_inc_xml
| search (product_name="prod name" OR product_name="prod name2") AND service_type="User*" AND status="Closed" OR status="Resolved"
| stats latest(product_name) as product_name, latest(login_id) as login_id, latest(resolution_category_tier_2) as All_res_cat_2 by incident_number
| lookup userid_lookup.csv impacted_Userid as login_id OUTPUTNEW impacted_Name impacted_Company impacted_street_address
| stats count(incident_number) as ALL_count by impacted_Name, impacted_Company, impacted_street_address
| join impacted_Name type=outer [search (product_name="prod name" OR product_name="prod name2") AND service_type="User*" AND status="Closed" OR status="Resolved" AND resolution_category_tier_2="Process" OR resolution_category_tier_2="Training"
| stats latest(product_name) as product_name, latest(login_id) as login_id, latest(resolution_category_tier_2) as PT_res_cat_2 by incident_number
| lookup userid_lookup.csv impacted_Userid as login_id OUTPUTNEW impacted_Name impacted_Company impacted_street_address
| stats count(incident_number) as PT_count by impacted_Name, impacted_Company, impacted_street_address ]
| table impacted_Name ALL_count PT_count
... View more