Splunk Search

Can you help me with my filtering search?

New Member

Hi,

I am trying to create a list of customers based on one event type but then show stats from all the events by those customers. I tried the following:

index=event
| join type=inner Username
[ search index=event event_type=web_login ]
| stats sum(purchase.amount)

But with this structure, I only get purchase.amount for web_login event whereas I want to have a sum from all events from those customers.

Thanks in advance,
Simon.

0 Karma

SplunkTrust
SplunkTrust

A subsearch without join should work for that.

index=event [ search index=event event_type=web_login Username=* | fields Username | format ]
| stats sum(purchase.amount)
---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!