I have a index named Events
Example events:
AccountCreated
{
"AccountId": 1234,
"EventName": "AccountCreated",
"SomeOtherProperty": "Some value"
}
FavoriteCreated
{
"AccountId": 1234,
"EventName": "FavoritesCreated
}
Let's say that I have a bunch of these events, like millions.
Now, I want to create a query that returns the AccountCreated event IF 1 (or more) FavoriteCreated event exists with the same AccountId.
I've tried the following query and it works
index=events EventName=AccountCreated
[search index=events EventName=FavoriteCreated | dedup AccountId | fields AccountId]
| table AccountId, SomeOtherProperty
The only problem with that one is that it's using a subsearch and im hitting the 10000 results limit.
So then I tried using a JOIN instead (this also works)
index=events EventName=AccountCreated AccountId=*
| stats count by AccountId, EventName
| fields - count
| join AccountId
[ | search index=events EventName=FavoriteCreated AccountId=*
| stats count by AccountId ]
| fields - count
| table AccountId, EventName
...but now im facing the 50K events limit (JOIN subsearch).
So, I need to be able to write the query without using JOIN and/or subsearch, do you guys have any tips?
... View more
