Can you help me with my filtering search?

[simbug]

Hi,

I am trying to create a list of customers based on one event type but then show stats from all the events by those customers. I tried the following:

index=event
| join type=inner Username
[ search index=event event_type=web_login ]
| stats sum(purchase.amount)

But with this structure, I only get purchase.amount for web_login event whereas I want to have a sum from all events from those customers.

Thanks in advance,
Simon.

[richgalloway]

A subsearch without join should work for that.

index=event [ search index=event event_type=web_login Username=* | fields Username | format ]
| stats sum(purchase.amount)