I have a script:
index=idaas EventType=Start OR EventType=Pass OR EventType=SignIn | eventstats dc(UserID) as dcUser by EventType | stats count by dcUser
This shows me distinct count of UserID's for each event. However, I am now trying to know how many unique Users hit all 3 events. Basically, the main outcome is to work out how many people have started, they get a pass event but we do not record a SignIn.
Any help would be great - I did try transaction but I can only tie together 2 events and not 3.
Thanks for your help
... View more