![]() ![]() Or perhaps there is a better way of combining the information without using transaction at all. I think this is due to memory limits in the nf and these could be increased, but it seems that there should be smarter options.įor example appending new events with a transaction command on an existing lookup if that is possible. However, for the remaining 13% there are still duplicate 's meaning that the transaction command has not combined them properly. I run a transaction command on the last two weeks, which gives about 20.000 events, and for about 85 percent of events the transaction command combines the events perfectly. ![]() Hoping someone can give some pointers how to solve this problem: It works perfectly when i optimize the subquery having lookup to have less than 50,000 rows. But the results are not coming as expected. I have a scenario where the nf default value for join and subquery has been increased and also am using max=0 in my join. Is there a difference in join limit set in nf for data from Index and data from lookup. Can it be used instead of join when data is from a lookup.Ĥ. Does lookup command have limitations like the join command like, what is the max limit for a lookup command. I would like to understand what is the search performance differnce when data is from a lookup or loaded from index.ģ. This has caused a lot of problems in the join conditions made in the query.ġ. And over time the lookup has increased in size going more than 1,00,000 rows. The existing dashboard has been created by joining atleast 10 lookup files in the same query for a panel. | table userid inlist app1 app2 app3 app4Īm trying to optimize the performance of a dashboard that was built some time back. | convert timeformat="%m/%d/%Y" ctime(app1) ctime(app2) ctime(app3) ctime(app4) [| search index=app4 status=success userid=* [| search index=app3 status=success userid=* [| search index=app2 status=success userid=* [| search index=app1 status=success userid=* We created the following to build it (And added an "inlist" column that says "True" based on other examples) but are struggling to 'update' once built. ![]() We've been able to successfully append the lookup using a combination of input and outputlookup but unable to modify a specific row. The table below should hopefully self-explain the desired outcome. Lastupdate should always equal the latest date in one of the application columns. Date added would be the date the user had first logged into *any* application. Ideally, it has a few tracking columns at the end to track last updated and first added. I'm trying to build a lookup table that will update based on the latest time a user logged into a particular application. ![]()
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |