Cant use join in a scheduled view
Cant use a join in a scheduled view, what are the alternatives.
Query:
_sourceCategory=<redacted> "mimeType stats"
| timeslice 1m | join
(parse "restsdk :*" as jsonobject
| json field=jsonobject "count"
| extract field=count "(?<item>\{.*?\}.*?)" multi
| json field=item "count", "mimeType" as fcount, ftype
| format("%s/%s",_messagetime,ftype) as ftype
|parse field=_sourceName "*" as deviceid
| fields deviceid, ftype, fcount
|fields - _raw
| sum (fcount) as filecount group by deviceid, ftype
|order by deviceid
| split ftype delim='/' extract 1 as date, 2 as file_type, 3 as file_extension) as ctable,
(parse "restsdk :*" as jsonobject
| json field=jsonobject "size"
| extract field=size "(?<item>\{.*?\}.*?)" multi
| json field=item "size", "mimeType" as fsize, ftype
| format("%s/%s",_messagetime,ftype) as ftype
|parse field=_sourceName "*" as deviceid
| fields deviceid, ftype, fsize
|fields - _raw
| sum (fsize) as filesize group by deviceid, ftype
|order by deviceid
| split ftype delim='/' extract 1 as date, 2 as file_type, 3 as file_extension ) as stable
on ctable.deviceid = stable.deviceid
and ctable.ftype = stable.ftype
| fields ctable_deviceid, ctable_ftype, ctable_filecount, stable_filesize
| split ctable_ftype delim='/' extract 1 as date, 2 as file_type, 3 as file_extension
| fields - ctable_ftype
Please sign in to leave a comment.
Comments
0 comments