Splunk Search

Dedup and 'OR' problem

New Member

Hi. I'm quite newbie in Splunk, but I'm trying to find solution to my problem.



index=zt2 (first_search) OR (second_search)
|dedup USER_ID
|eval xxx=if(searchmatch("first_search"), 1, 0)
|eval yyy=if(searchmatch("secont_search"), 1, 0)
|stats count(eval(xxx=1)) as "XXX",
count(eval(yyy=1)) as "YYY"



I would like to count unique USER_ID per each eval expression, but problem is sometimes this same USER_ID appears in both searches (first_search and second_search), and dedup doesn't work correctly.

How do I make dedup affect xxx and yyy separately in eval?

Labels (2)
Tags (1)
0 Karma



index=zt2 (first_search) OR (second_search)
|stats count(eval(searchmatch("first_search"))) as "XXX",
count(eval(searchmatch("secont_search"))) as "YYY" by USER_ID


How about this?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.