What is most efficient way to join 2 broken sources?

[P3P4]

Hi,

I have 2 sources of data.
One contains visitor statistics similar to this format:
visitorID="154";visitorName="Bob";visitorCreated="5/6/2012"

Other one contains visitor actions similar to this format:
actionID="57798";actionVisitorID="154";actionTitle="forum comment";actionCreated="6/6/2012"

What I'm looking for is to create report with most active visitors over span of two years. Each visitor can have up to 1000 actions and there are more than 60000 visitors per day on average.

Firstly, each visitor has multiple records spanning over long period, therefore I cannot create event correlation over time.

Secondly, some records are broken. Not every action has corresponding visitor and vice versa. I would like to create report only on those records which are not broken.

I was thinking of something like this:

source=visitor [search source=action [search source=visitor | rename visitorID as actionVisitorID] | top actionVisitorID | rename actionVisitorID as visitorID]

In other words: search for actions, but limit only those which has matching visitors and get me only most active. Then project results to visitor and display most active visitor records.

Cheers

[eashwar]

you can use OR to do the job

source=visitor OR source=action | rex field=actionVisitorID "^(?P<visitorID>\d+)" | top visitorID

you can also use rename actionVisitorID AS visitorID instead of using rex.

finish your search by | top visitorID

or you can also do a transaction if you want to group the events by visitorID

| transaction visitorID

i hope now you can find the most active users beased on the eventcount or the mvcount of the data field.