Dedup and 'OR' problem

[Reijo86]

Hi. I'm quite newbie in Splunk, but I'm trying to find solution to my problem.

index=zt2 (first_search) OR (second_search)
|dedup USER_ID
|eval xxx=if(searchmatch("first_search"), 1, 0)
|eval yyy=if(searchmatch("secont_search"), 1, 0)
|stats count(eval(xxx=1)) as "XXX",
count(eval(yyy=1)) as "YYY"

I would like to count unique USER_ID per each eval expression, but problem is sometimes this same USER_ID appears in both searches (first_search and second_search), and dedup doesn't work correctly.

How do I make dedup affect xxx and yyy separately in eval?

[to4kawa]

index=zt2 (first_search) OR (second_search)
|stats count(eval(searchmatch("first_search"))) as "XXX",
count(eval(searchmatch("secont_search"))) as "YYY" by USER_ID

How about this?