Hi,
I have 2 sources of data.
One contains visitor statistics similar to this format:
visitorID="154";visitorName="Bob";visitorCreated="5/6/2012"
Other one contains visitor actions similar to this format:
actionID="57798";actionVisitorID="154";actionTitle="forum comment";actionCreated="6/6/2012"
What I'm looking for is to create report with most active visitors over span of two years. Each visitor can have up to 1000 actions and there are more than 60000 visitors per day on average.
Firstly, each visitor has multiple records spanning over long period, therefore I cannot create event correlation over time.
Secondly, some records are broken. Not every action has corresponding visitor and vice versa. I would like to create report only on those records which are not broken.
I was thinking of something like this:
source=visitor [search source=action [search source=visitor | rename visitorID as actionVisitorID] | top actionVisitorID | rename actionVisitorID as visitorID]
In other words: search for actions, but limit only those which has matching visitors and get me only most active. Then project results to visitor and display most active visitor records.
Cheers
... View more