This is the piece of code i tried so far but the join part is not working for me i don't know why  ((index="ata" sourcetype="s:sv" y_id>=4 te>= [| makeresults |eval start_date=strftime(relative_time(now(), "-30d@d"),"%Y-%m-%dT%H:%M:%SZ") | fields start_date | return $start_date] earliest=-90d@d [|join type="inner" id [search index="ys_kb" sourcetype="lys:b_l" y_id>=4 ble=1 | dedup id | fields id |return id ]]) OR (index="s_ata" sourcetype="lys:h_xl" os=* earliest=-90d@d)) ... View more

Since I am new to Splunk is there is demo query for calculating this will be helpful,Basically, i want to count one field multiple times with the different condition ... View more