list common uid on two hosts

[nikkuu]

I am trying to list out common uid on two different hosts.
I am using this but this give a visual of all uids including the common ones.
sourcetype=access $host1$ OR $host2$ error=2*| chart max(O) over host by uid

[somesoni2]

It will depend a lot on what's your final output should be. If you just want to know list of uid which are on both hosts, you could do like this

sourcetype=access $host1$ OR $host2$ error=2* | stats dc(host) as host_count by uid | where host_count=2

If you want list hosts as well,

sourcetype=access $host1$ OR $host2$ error=2*| chart dc(uid) over host by uid | addtotals | where Total=2

[snoobzilla]

Eventstats should work, though not terribly efficient...

sourcetype=access $host1$ OR $host2$ error=2*
| eventstats dc(host) AS hosts by uid
| search hosts>1
| chart max(O) over host by uid