Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Is there a design pattern for join queries with simple data?

$
0
0
Hi, I am trying to write a query that seems a bit more tricky than it first looked like... ;-) We have a scenario where users log on to a service and the performs several transactions. In a day there can be more than 50000 customers, and each customer can have between 100 and 5000 transactions in several different sessions on different client_types. We have 2 events with this type of data: timestamp event=login accountid=12345 client_type=mobile timestamp event=trans accountid=12345 amount=7 timestamp event=trans accountid=12345 amount=3 timestamp event=login accountid=88888 client_type=mobile timestamp event=trans accountid=12345 amount=9 timestamp event=trans accountid=12345 amount=5 timestamp event=trans accountid=88888 amount=3 timestamp event=login accountid=12345 client_type=web timestamp event=trans accountid=12345 amount=9 timestamp event=trans accountid=12345 amount=5 I am trying to do a report on sum(amount) by client_type. We assume that all trans events have the same client_type until next login event occurs. The transaction command will fail due to tha number of events... // Andreas

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>