In a time limited table, I'd like to indicate which field values are unique across the whole data set?

[jezwebb]

Hi there,

I have this dashboard that displays a table of field values from a data set. At the top are some filters, including time range. I'd like to indicate in the table which values in a certain field are unique across all time - i.e. have never been seen in the whole data set.

For example if, in the last 24 hours, the user names "Bill", "Fred" and "Emmy" have been input but only "Emmy" has never been seen in the data set ever, I want that flagged up.

I really would want the solution to be "live" i.e. not rely on a lookup table but be computationally light as the dashboard refreshes regularly.

Suggestions welcome!

Jeremy.

[DalJeanis]

Three strategies:

1) If this is an indexed field, then you can use tstats to find the first instance of the value.

2) You could create a summary index that includes the first and last appearance of the value.

3) You could periodically create a lookup table that includes the first and last appearance of the value.

It's not particularly heavy to periodically create a lookup table with first and last occurrence of each username,

Then you create your ongoing search that creates a new record for each occurrence, with first and last occurrence fields set to the new data/time stamp, and stats them together to get the earliest first and latest last occurrence fields for each.

If the first and last occurrence are the same -- or if the first occurrence is within a certain window, then a post process search would pop them over to a second panel.