title: Get unique count by matchin partial string in logs
body: <p>I want to find out how many users have blue colors &amp; how many of them have red color for all unique users?</p>
  
  <pre><code>[2011-09-30 18:15:01:559 GMT+00:00][137D3B5A5F196F81A405858E6A5AA01F.maps-358-thread-1][com.abc.myaction.myfilter] INFO email=abc@hotmail.com userid=1234
  [2011-09-30 18:15:01:559 GMT+00:00][237D3B5A5F197F81A405858E6A5AA0WD.maps-158-thread1][com.abc.myaction.myfilter] INFO email=pqr@rff.com userid=4235
  [2011-09-30 18:15:01:559 GMT+00:00][337D3B5A5F198F81A405858E6A5AA0GW.maps-258-thread-1][com.abc.myaction.myfilter] INFO email=xyz@abc.com userid=7645
  [2011-09-30 18:14:58:768 GMT+00:00][237D3B5A5F198F81A405858E6A5AA09F.http-8080-11][com.pqr.abclogging.mywrapper] DEBUG redColor=true blueColor=false
  [2011-09-30 18:14:58:768 GMT+00:00][237D3B5A5F197F81A405858E6A5AA0WD.http-8080-11][com.fff.filter] DEBUG redColor=true blueColor=false
  [2011-09-30 18:14:58:768 GMT+00:00][137D3B5A5F196F81A405858E6A5AA01F.http-8080-11][com.xyz.wrapper] DEBUG redColor=false blueColor=true
  [2011-09-30 18:14:58:768 GMT+00:00][337D3B5A5F198F81A405858E6A5AA0GW.http-8080-11][com.xyz.wrapper] DEBUG redColor=false blueColor=true
  </code></pre>
  
  <p>In above log, I've to get all distinct users &amp; then for each user, I need to get their session id &amp; them match it within the line that contains the DEBUG &amp; check if redColor=true or not.</p>
  
  <p>So, in above case, the output should be:</p>
  
  <p>No of users with red color = 1 (Note: 237D3B5A5F198F81A405858E6A5AA09F does not match with anything, hence not counted even though its red flag is true) No of users with blue color = 2</p>
  
  <p>Is this possible within splunk?</p>