I have 2 accelerated data models defined, both having a common field (AccountId in one and account_id in another). The events run into millions of events for the first data model and hundreds of thousands for the second data model. I am now trying to get data across these 2 sets, can you please help me get the best approach.
First Data Model is a JSON file, from which i've extracted fields:
Field1, Field2, Field3, AccountId......
Second Data Model is a search ---> index=index1 sourcetype=st1
Fieldx, Fieldy, account_id, Fieldz.......
I have tried:
Left Join : This one takes way too long to return the search result, but have noticed that the results from the inner search are duplicated - not really correlating the data correctly.