https://community.splunk.com/t5/Splunk-Search/Dedup-and-OR-problem/m-p/526038#M148476 <P>&nbsp;</P><LI-CODE lang="markup">index=zt2 (first_search) OR (second_search) |stats count(eval(searchmatch("first_search"))) as "XXX", count(eval(searchmatch("secont_search"))) as "YYY" by USER_ID</LI-CODE><P>&nbsp;</P><P>How about this?</P> Thu, 22 Oct 2020 13:54:53 GMT to4kawa 2020-10-22T13:54:53Z https://community.splunk.com/t5/Splunk-Search/Dedup-and-OR-problem/m-p/526032#M148473 <P>Hi. I'm quite newbie in Splunk, but I'm trying to find solution to my problem.</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">index=zt2 (first_search) OR (second_search) |dedup USER_ID |eval xxx=if(searchmatch("first_search"), 1, 0) |eval yyy=if(searchmatch("secont_search"), 1, 0) |stats count(eval(xxx=1)) as "XXX", count(eval(yyy=1)) as "YYY"</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>I would like to count unique USER_ID per each eval expression, but problem is sometimes this same USER_ID&nbsp;appears in both searches (first_search and second_search), and dedup doesn't work&nbsp;<SPAN>correctly.</SPAN></P><P><SPAN>How do I make dedup affect xxx and yyy separately in eval?</SPAN></P> Thu, 22 Oct 2020 13:33:38 GMT https://community.splunk.com/t5/Splunk-Search/Dedup-and-OR-problem/m-p/526032#M148473 Reijo86 2020-10-22T13:33:38Z https://community.splunk.com/t5/Splunk-Search/Dedup-and-OR-problem/m-p/526038#M148476 <P>&nbsp;</P><LI-CODE lang="markup">index=zt2 (first_search) OR (second_search) |stats count(eval(searchmatch("first_search"))) as "XXX", count(eval(searchmatch("secont_search"))) as "YYY" by USER_ID</LI-CODE><P>&nbsp;</P><P>How about this?</P> Thu, 22 Oct 2020 13:54:53 GMT https://community.splunk.com/t5/Splunk-Search/Dedup-and-OR-problem/m-p/526038#M148476 to4kawa 2020-10-22T13:54:53Z