topic Re: How do you count Unique IDs, in both indexes, based on a specific event? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-you-count-Unique-IDs-in-both-indexes-based-on-a-specific/m-p/429601#M122870 <P>(index=capi_event event_name="AccountFinalized" OR event_name="AccountActivated" account_id ) AND ( index=piq_event event_name="DEPOSIT" account_id state!="WAITING_INPUT") <BR /> | stats values(account_id)</P> Tue, 29 Sep 2020 22:27:46 GMT valiquet 2020-09-29T22:27:46Z How do you count Unique IDs, in both indexes, based on a specific event? https://community.splunk.com/t5/Splunk-Search/How-do-you-count-Unique-IDs-in-both-indexes-based-on-a-specific/m-p/429599#M122868 <P>I am trying to get Unique IDs (appears in both indexes) but I only want to count if there is event_name="AccountFinalized OR event_name="AccountActivated" in index 1 AND event_name="Deposit" in index 2.</P> <PRE><CODE>(index=capi_event event_name="AccountFinalized" OR event_name="AccountActivated" account_id ) OR (index=piq_event ) | join type=inner "account_id" [search index=piq_event event_name="DEPOSIT" account_id state!="WAITING_INPUT"] | stats dc(account_id) AS uniqueID dc(status) AS uniqueStatus count(state) AS State by event_name | </CODE></PRE> Tue, 29 Sep 2020 22:20:51 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-count-Unique-IDs-in-both-indexes-based-on-a-specific/m-p/429599#M122868 diegofavoretto 2020-09-29T22:20:51Z Re: How do you count Unique IDs, in both indexes, based on a specific event? https://community.splunk.com/t5/Splunk-Search/How-do-you-count-Unique-IDs-in-both-indexes-based-on-a-specific/m-p/429600#M122869 <P>Hello @diegofavoretto,</P> <P>You can use a subsearch to filter for IDs in the second index:</P> <PRE><CODE>index=capi_event event_name="AccountFinalized" OR event_name="AccountActivated" [search index=piq_event event_name="DEPOSIT" | table account_id] | stats ... </CODE></PRE> Wed, 12 Dec 2018 18:14:20 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-count-Unique-IDs-in-both-indexes-based-on-a-specific/m-p/429600#M122869 whrg 2018-12-12T18:14:20Z Re: How do you count Unique IDs, in both indexes, based on a specific event? https://community.splunk.com/t5/Splunk-Search/How-do-you-count-Unique-IDs-in-both-indexes-based-on-a-specific/m-p/429601#M122870 <P>(index=capi_event event_name="AccountFinalized" OR event_name="AccountActivated" account_id ) AND ( index=piq_event event_name="DEPOSIT" account_id state!="WAITING_INPUT") <BR /> | stats values(account_id)</P> Tue, 29 Sep 2020 22:27:46 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-count-Unique-IDs-in-both-indexes-based-on-a-specific/m-p/429601#M122870 valiquet 2020-09-29T22:27:46Z