Query Optimization: How best to consolidate fields across multiple records into a single record.


1 comment

  • Official comment
    Rick Jury

    hi Austin, 

    the values operator will likely save the day here as it will merge all possible values into one field using one more aggregate fields. If there are only two options: null or a value A you will just get A as the final value. It's often a easy alternative to transactionize for a use case like this.

    so you could do something like
    _sourcecategory=Loga or _sourcecategory=logB

    | parse ... as sessionid 

    | parse ... as A nodrop

    | parse ... as B nodrop

    | values (A) as A, values(B) as B by sessionid


    you can have more than one field in the aggregation too if they always have a value say 

    | count as events,values (A) as A, values(B) as B by sessionid,field1,field2,field3.. etc

    Comment actions Permalink

Please sign in to leave a comment.