topic Re: Data Model or Pivot dedup in Knowledge Management

Data Model or Pivot dedup

romansul — Mon, 18 Mar 2019 14:38:16 GMT

I generated a Data Model and accelerated it. The data consists of Months (Jan, Feb, etc), Suppliers(A, B,C), Machines (hostnames) and the final output has to be a stacked barchart displaying count of Providers events on our Machines per Months.

The issue is that I only have to count a maximum of 1 event per Machine in a month. When I only searched directly, a simple "| dedup Month Provider Hostname" solved the problem but now, as the data model must be accelerated, I cannot use dedup. Also, I cannot find how to use dedup in the barchart search generated by Pivot UI.

Could somebody please point me a direction regarding a dedup alternative for DataModels or Pivot searches?
Thanks!

Re: Data Model or Pivot dedup

lakshman239 — Tue, 29 Sep 2020 23:45:41 GMT

You could use | from datamodel:"your_dm_name" | stats count(Providers) count(hostname) by month and change as needed.

Re: Data Model or Pivot dedup

romansul — Tue, 19 Mar 2019 08:03:33 GMT

Thanks for the reply. If i use "datamodel" i've noticed that it will load the data very slow, as it will not use the accelerated version. Is there a way of specifying to use the accelerated data?

Re: Data Model or Pivot dedup

lakshman239 — Tue, 19 Mar 2019 12:09:50 GMT

you can use tstats , say something like | tstats count(Providers) count(hostname) from datamodel="your_dm_name" groupby dm_name.month

change as per your field names