Thanks for the explanation. However I am looking for a detail list of the count of each product that has been bought by the most common IP address.
I have tried different ways like below query but it does not produce the result that I want.
sourcetype=access_* status=200 action=purchase [search sourcetype=access_* status=200 action=purchase | top limit=1 clientip | table clientip] | stats count AS "Total Purchased", dc(productId) AS "Total Products", values(productId) AS "Products ID", count(values(productId)) by clientip | rename clientip AS "VIP Customer"
... View more