Do I need to run this search twice?

[tread_splunk]

I have the following fabricated search which is a pretty close representation of what I actually want to do and gives me the results I want...

(index=_audit (action=search OR action=GET_PASSWORD)) OR (index=_internal 
    [ search index=_audit (action=search OR action=GET_PASSWORD) 
    | dedup user 
    | table user] ) 
| stats count(eval(index="_audit")) as count, values(clientip) as clientip,count(eval(index="_internal")) as internalCount by user

i.e for everyone who has performed a search or GET_PASSWORD in one index, I want to know something about them gathered from both indexes.  I can't get past the feeling that I shouldn't need to repeat the "index=_audit (action=search OR action=GET_PASSWORD)" search, which in the actual search is whole lot of SPL, so duplicating it makes things untidy.  Macros aside, can anyone come up with a more elegant solution?

[victor_menezes]

Hey @tread_splunk ,
Not gonna lie, it seems a bit confuse to understand your goal here.
Both actions search and GET_PASSWORD only resides in _audit index, while internal index will have other kind of information.
IF what you want is just use the internal logs to get the source clientip for that user (not exactly related to the action calls though) you can try something like this:

index=_audit (action=search OR action=GET_PASSWORD)
| stats count as audit_count by user
| join user
[ search index=_internal sourcetype=splunkd_access user=* clientip=*
| stats count as internal_count by user clientip]
| table user clientip audit_count internal_count

The counts on audit and internal is the part that doesn't make much sense to me unless you want to filter the URI in the internal logs to something that is triggered during action=search or action=GET_PASSWORD, so you can customize my query a bit more.

If I'm tripping, please help me understanding your goal so I can try to give you more insights if any.