https://community.splunk.com/t5/Splunk-Search/Correlating-values-in-different-index/m-p/708535#M239602 <LI-CODE lang="markup">index IN (cart purchased) cart_id=* OR pur_id=* | eval common_id=coalesce(cart_id, pur_id) | eventstats dc(index) as common_count by common_id | where index="cart" | stats count as carts count(eval(common_count &gt; 1)) as purchases | eval pct=(purchases*100)/carts | table carts purchases pct</LI-CODE> Sat, 11 Jan 2025 21:49:03 GMT ITWhisperer 2025-01-11T21:49:03Z https://community.splunk.com/t5/Splunk-Search/Correlating-values-in-different-index/m-p/708531#M239599 <P>Hi,</P><P>I have two indexes - "cart" and "purchased" . In "cart" index there is a field "cart_id" and in "purchased" there is a field "pur_id".&nbsp; If&nbsp; payment will be successfully for a cart then the card_id values will be stored as a pur_id in the "purchased" index.</P><P>cart&nbsp;purchased&nbsp;</P><P>cart_id 123 payment received&nbsp; pur_id&nbsp; &nbsp;123</P><P>cart_id 456&nbsp;&nbsp; no payment&nbsp; no record for 456</P><P>Now I want to display the percentage of cart for which payment is done.</P><P>I wonder if anyone can help here.</P><P>&nbsp;</P><P>Thank you so much&nbsp;</P> Sat, 11 Jan 2025 19:04:41 GMT https://community.splunk.com/t5/Splunk-Search/Correlating-values-in-different-index/m-p/708531#M239599 Souradip11 2025-01-11T19:04:41Z https://community.splunk.com/t5/Splunk-Search/Correlating-values-in-different-index/m-p/708533#M239601 <P>Perhaps this will help.&nbsp; It counts the number of unique cart and purchase IDs then does the math to find the percentage of paid carts.</P><LI-CODE lang="markup">index IN (cart purchased) cart_id=* OR pur_id=* | stats dc(cart_id) as carts, dc(pur_id) as purchases | eval pct=(purchases*100)/carts | table carts purchases pct</LI-CODE> Sat, 11 Jan 2025 19:35:11 GMT https://community.splunk.com/t5/Splunk-Search/Correlating-values-in-different-index/m-p/708533#M239601 richgalloway 2025-01-11T19:35:11Z https://community.splunk.com/t5/Splunk-Search/Correlating-values-in-different-index/m-p/708535#M239602 <LI-CODE lang="markup">index IN (cart purchased) cart_id=* OR pur_id=* | eval common_id=coalesce(cart_id, pur_id) | eventstats dc(index) as common_count by common_id | where index="cart" | stats count as carts count(eval(common_count &gt; 1)) as purchases | eval pct=(purchases*100)/carts | table carts purchases pct</LI-CODE> Sat, 11 Jan 2025 21:49:03 GMT https://community.splunk.com/t5/Splunk-Search/Correlating-values-in-different-index/m-p/708535#M239602 ITWhisperer 2025-01-11T21:49:03Z