Hi,
I am trying to get the execution count based on the parentIDs over two different data sets. Please could you review and suggest ?
I would like to see what's execution count between (sourcet...
See more...
Hi,
I am trying to get the execution count based on the parentIDs over two different data sets. Please could you review and suggest ?
I would like to see what's execution count between (sourcetype=cs, sourcetype=ma) , only the field ParentOrderID is common between cs, ma sourcetype.
Note: daily close to ~10Million events are loaded into splunk and unique execution will be 4Million.Also, sometime the join query is getting auto-canceled.
SPL:
index=india sourcetype=ma NOT (source=*OPT* OR app_instance=MA_DROP_SESSION OR "11555=Y-NOBK" OR fix_applicationInstanceID IN(*OPT*,*GWIM*)) msgType=8 (execType=1 OR execType=2 OR execType=F) stream=Outgoing app_instance=UPSTREAM "clientid=XAC*"
| dedup fix_execID,ParentOrderID
| stats count
| join ParentOrderID
[ search index=india sourcetype=cs NOT (source=*OPT* OR "11555=Y-NOBK" OR applicationInstanceID IN(*OPT*,*GWIM*)) msgType=8 (execType=1 OR execType=2 OR execType=F) app_instance=PUBHUB stream=Outgoing "clientid=XAC" "sourceid=AX_DN_XAC"
| dedup execID,ParentOrderID
| stats count]
Thanks,
Selvam.