title: Splunk how to combine two queries and get one answer
body: <p>I am very new to Splunk and basically been dropped in the deep end!! also very new to language so any help and tips on the below would be great.</p>
  
  <p>The out come i am trying to get is to join the queries and get Username, ID and the amount of logins.</p>
  
  <p>The queries are from diff source, sourcetype and host.</p>
  
  <p>Query 1 is Username and ID and Query 2 is Username and Count of logins. </p>
  
  <p>Query 1:
  userName="<em>" entityNumber="</em>" | eval userName=upper(userName) | dedup userName, entityNumber | rename userName as User | table User, entityNumber </p>
  
  <p>Query 2:
   "Successfully logged in."   | rex field=_raw  "User[\":]<em>(?[^\"IP]</em>)"| eval User=upper(User) |  Table User | stats count by User </p>
  
  <p>Thanks in advance for your help.
  J</p>