Splunk Search

Can you help me with my filtering search?

New Member


I am trying to create a list of customers based on one event type but then show stats from all the events by those customers. I tried the following:

| join type=inner Username
[ search index=event event_type=web_login ]
| stats sum(purchase.amount)

But with this structure, I only get purchase.amount for web_login event whereas I want to have a sum from all events from those customers.

Thanks in advance,

0 Karma


A subsearch without join should work for that.

index=event [ search index=event event_type=web_login Username=* | fields Username | format ]
| stats sum(purchase.amount)
If this reply helps you, an upvote would be appreciated.
0 Karma