how to do a match field between index and summary index Finding match TraceID

[Cheng2Ready]

Without using a SubSearch since there is a limit of 10000 results


index="xxxx" field.type="xxx" OR index=Summary_index
| eventstats values(index) as sources by trace
| where mvcount(sources) > 1

| spath output=yyyId path=xxxId input=_raw
| where isnotnull(yyyId) ANDyyyId!=""
| bin _time span=5m AS hour_bucket
| stats latest(_time) as last_activity_in_hour, count by hour_bucket, yyyId
| stats count by hour_bucket
| sort hour_bucket
| rename hour_bucket AS _time
| timechart span=5m values(count) AS "Unique Customers per Hour"

Still doesn't return any results

[PickleRick]

1. We don't know neither your events nor your summary index contents.

2. There is much going on here. Try to avoid eventstats if possible. It's a "heavy" command and can run out of memory.

3. You bin by 5m but name your fields as if it was hourly.

4. You're generating several fields which you don't use later.

[gcusello]

Hi @Cheng2Ready ,

at first don't rename hour_bucket,

then don't use values in timechart command,

then why are you using all these stats?

at least why do you want to list all the values of count without the yyyId? what do you want to extract?

please try:

(index="xxxx" field.type="xxx") OR index=Summary_index
| eventstats values(index) as sources by trace
| where mvcount(sources) > 1
| spath output=yyyId path=xxxId input=_raw
| where isnotnull(yyyId) ANDyyyId!=""
| bin _time span=5m
| stats 
     latest(_time) AS last_activity_in_hour
     count 
     BY _time yyyId
| stats  values(count) AS "Unique Customers per Hour" BY _time

 Could you share more detals about your requirement?

Ciao.

Giuseppe

[ITWhisperer]

Try removing lines from th end of the search, one at a time, until the results appear, then you will know which line is causing the problem.

If that doesn't work, try sharing some events from the index and the summary index to show us what you are dealing with.