Hi Everyone
I have an index, under which records are coming at 30 seconds.
I have one lookup, which is having some fields.
Both Index and Lookup has one common field, on the basis of what I have get all matching rows.
After Getting data, I need to perform aggregations on day basis.
|inputlookup lookupname| join type=inner lookup_field[search index="abc" | rename index_field as "lookup_field"]
This is giving 500 records and not getting proper results.
index="abc" | join type=inner index_field[|inputlookup lookupname | rename "lookup_field" as "index_field"]
This is giving almost 2 lack records. But whenever I am using this is my dashboard, it is taking lot of time to display.
Which one is correct way of joining, if second one is corect, How to make it optimize?
Dashboard is getting refreshed at every 30 seconds interval.
Please guide on this.
Thanks
Nikks
... View more