Thank in Advance
I have three source type Micro, application, CsID and i want to fetch details from these three source type .In Micro source type i want to run every 11 hours and other two source type with all time.
1.In micro source type i want to populate 16 fields in this i have cluster, namespace, microservice etc.
2.In Application source type i have cluster, namespace and csid.
3.In csid source type i have only csid but i want populate all the fields from this source type .
How to merge all those without join. Its working in join but while using in dashboard its very slow .I will paste sample query which i tried but i cant able to get data from csid source type and in micro field name as cluster but in other sourcetype as ose_cluster and we also map using lookup file for ose_cluster.
(index=int* (sourcetype="micro" OR sourcetype="application" OR sourcetype="csiID" NOT "test_cluster"))
| eval creation_time_epoch=creation_time
| eval creation_time_human=strftime(creation_time, "%Y-%m-%d %H:%M:%S")
|eval ose_cluster=coalesce(ose_cluster,cluster)
|eval csiId=trim(toString(csiId)),namespace=trim(lower(namespace))
|stats values(*) as * by ose_cluster namespace |mvexpand csiId
|stats latest(*) as * by ose_cluster csiId
|lookup inventory.csv ose_cluster OUTPUT sector as cluster_sector datacenter region env
|fillnull value="NA"
| table ose_cluster namespace type microservice creation_time_epoch creation_time_human cluster_sector app_sector datacenter region env csiId acronym applicationName applicationManager soeid
supportManager status org level3 level4 level5
