I have a search that counts the amount of times a user runs a program, and then returns the usernames of the users who run it more than threshold 'x_times'. The search requires information from two sourcetypes that have one 'event_id' in common.
index=blah (sourcetype=example_1 OR sourcetype=example_2) earliest=-1d@d
| stats values(username), values(type), values(program_name), values(hostname) by event_id
| search type=filter_1 program_name=filter_2
| eventstats count as user_count by username
| search user_count >= 5
| table username
My goal, is that after I have the usernames I'm interested in, I want to be able to run predictions on each username. I have tried this two ways:
Way 1
| map search="search index=blah (sourcetype=example_1 OR sourcetype=example_2) earliest=-90d@d
| stats values(username), values(type), values(program_name), values(hostname) by event_id
| search username=$username$ type=filter_1 program_name=filter_2
| timechart span=1d count as distinct_count
| predict disinct_count algorithm=LLP5
| table output1, output2, prediction"
Way 2
| map search="search index=blah sourcetype=example_1 earliest=-90d@d
| join event_id max=0 [ search index=blah sourcetype=example_2 earlies=-90d@d | table event_id, program_name]
| search username=$username$ type=filter_1 program_name=filter_2
| timechart span=1d count as distinct_count
| predict disinct_count algorithm=LLP5
| table output1, output2, prediction"
Experimentation has shown me that the map search can't seem to process past the STATS or the JOIN. Without the STATS or the JOIN, and then only being able to use one filter, I can get it to work. But with them it fails, and I'm unable to get an accurate prediction.
Is there a solution, or do I need to approach this a different way?
