Splunk Search

Dedup and 'OR' problem

New Member

Hi. I'm quite newbie in Splunk, but I'm trying to find solution to my problem.



index=zt2 (first_search) OR (second_search)
|dedup USER_ID
|eval xxx=if(searchmatch("first_search"), 1, 0)
|eval yyy=if(searchmatch("secont_search"), 1, 0)
|stats count(eval(xxx=1)) as "XXX",
count(eval(yyy=1)) as "YYY"



I would like to count unique USER_ID per each eval expression, but problem is sometimes this same USER_ID appears in both searches (first_search and second_search), and dedup doesn't work correctly.

How do I make dedup affect xxx and yyy separately in eval?

Labels (2)
Tags (1)
0 Karma



index=zt2 (first_search) OR (second_search)
|stats count(eval(searchmatch("first_search"))) as "XXX",
count(eval(searchmatch("secont_search"))) as "YYY" by USER_ID


How about this?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!