https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-my-filtering-search/m-p/453905#M128447 <P>A subsearch without <CODE>join</CODE> should work for that.</P> <PRE><CODE>index=event [ search index=event event_type=web_login Username=* | fields Username | format ] | stats sum(purchase.amount) </CODE></PRE> Tue, 11 Sep 2018 11:14:42 GMT richgalloway 2018-09-11T11:14:42Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-my-filtering-search/m-p/453904#M128446 <P>Hi,</P> <P>I am trying to create a list of customers based on one event type but then show stats from all the events by those customers. I tried the following:</P> <PRE><CODE>index=event | join type=inner Username [ search index=event event_type=web_login ] | stats sum(purchase.amount) </CODE></PRE> <P>But with this structure, I only get purchase.amount for web_login event whereas I want to have a sum from all events from those customers.</P> <P>Thanks in advance,<BR /> Simon.</P> Tue, 11 Sep 2018 09:36:10 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-my-filtering-search/m-p/453904#M128446 simbug 2018-09-11T09:36:10Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-my-filtering-search/m-p/453905#M128447 <P>A subsearch without <CODE>join</CODE> should work for that.</P> <PRE><CODE>index=event [ search index=event event_type=web_login Username=* | fields Username | format ] | stats sum(purchase.amount) </CODE></PRE> Tue, 11 Sep 2018 11:14:42 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-my-filtering-search/m-p/453905#M128447 richgalloway 2018-09-11T11:14:42Z