topic Re: Get distinct count from different sources in Splunk Search https://community.splunk.com/t5/Splunk-Search/Get-distinct-count-from-different-sources/m-p/681980#M233025 <P>Assuming that the fields only exist in their respective sourcetypes, you could try something like this</P><LI-CODE lang="markup">sourcetype=source1 OR sourcetype=source2 OR sourcetype=source3 | eval userlist=coalesce(userlist, line.userlist, line.subject) | stats dc(userlist)</LI-CODE> Tue, 26 Mar 2024 11:14:48 GMT ITWhisperer 2024-03-26T11:14:48Z Get distinct count from different sources https://community.splunk.com/t5/Splunk-Search/Get-distinct-count-from-different-sources/m-p/681974#M233024 <P>I have 3 different sources of the same filed. I want to aggregate all the 3 sources and get the distinct count of the field</P><P>eg.</P><P>sourcetype=source1 | stats dc(userlist)</P><P>sourcetype=source2 | stats dc(line.userlist)</P><P>sourcetype=source3 | stats dc(line.subject)</P><P>&nbsp;</P><P>Here userlist, line.userlist, line.subject are all the same attributes but being logged differently. Now I want to get the dc of userlist+line.userlist+line.subject. Any help is appreciated.</P> Tue, 26 Mar 2024 10:11:28 GMT https://community.splunk.com/t5/Splunk-Search/Get-distinct-count-from-different-sources/m-p/681974#M233024 raghubankapur 2024-03-26T10:11:28Z Re: Get distinct count from different sources https://community.splunk.com/t5/Splunk-Search/Get-distinct-count-from-different-sources/m-p/681980#M233025 <P>Assuming that the fields only exist in their respective sourcetypes, you could try something like this</P><LI-CODE lang="markup">sourcetype=source1 OR sourcetype=source2 OR sourcetype=source3 | eval userlist=coalesce(userlist, line.userlist, line.subject) | stats dc(userlist)</LI-CODE> Tue, 26 Mar 2024 11:14:48 GMT https://community.splunk.com/t5/Splunk-Search/Get-distinct-count-from-different-sources/m-p/681980#M233025 ITWhisperer 2024-03-26T11:14:48Z Re: Get distinct count from different sources https://community.splunk.com/t5/Splunk-Search/Get-distinct-count-from-different-sources/m-p/681988#M233027 <P>This works well&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P> Tue, 26 Mar 2024 12:15:12 GMT https://community.splunk.com/t5/Splunk-Search/Get-distinct-count-from-different-sources/m-p/681988#M233027 raghubankapur 2024-03-26T12:15:12Z