Hi everyone
How do I leave just unique events by specified field in an accelerated data model?
My base search looks like:
index=main source=transactions tx_type=purchase | `registration_time` | `type_user`
And I'm trying to add child dataset with just one constraint: dedup transaction_id
But it didn't work.
Duplicated transaction_id cannot be deleted from original source 'cause it's a feature of some transactions... But, in data model, we just need one occurrence of it, e.g. to sum revenue.
With this query we get a greater result than we actually have because of counting several times transactions with the same transaction_id. How can we get correct result?
Thanks in advance!
| tstats sum(transactions.price) AS Revenue from datamodel=transact.transactions where (nodename = transactions) groupby _time span=1month
| rename transactions.* as *
| timechart span=1month first(Revenue) as revenue
