I have two indexes that I need to search. For the first index, I need to count the total from a certain field however I need to dedup this field first. I have the same dilemma with the second index. I need to count the total but have to dedup as well. For example: index=MyIndex1 OR index=MyIndex2 | dedup MyIndex1Field | dedup MyIndex2Field | stats count MyIndexField1 as Total1, count MyIndexField2 as Total2 | eval CalcField=(Total1/Total2) There are some commands I will pipe in once I get this solved but for now just trying to figure this out. I keep getting issues when I dedup one or the other so the goal is to dedup both. Any help would be appreciated. ... View more