I am looking to correlate events from two different sources whereby a rare event in source A, (in a 1 hour window) searches for events in source B (in the same 1 hour window)
These are mobile phone records, and source A lists the Phone Numbers I want to seach for in the CDR logs (source B).
This is what I have so far:
This returns bucket windows for source A, but as the search runs it populates the first bucket where a cli appears with ALL the CDR records of the same device.
That is to say (over a 4 hour search window 08:00-12:00), if a phone made 1 call an hour in each of the 4 hours, then all 4 calls show up in the 08:00 result set.
I want to run this query over 30 days, and at the moment, every call gets returned in the first window in which its CLI was flagged in source A.
How can I restrict the 'join search' to only search within the same time window as the bucket from first search? I have looked at localize - map, but this seems problematic also.
Not trying to go into your question in depth, so I concentrating on your first paragraph.
Could you pick out
I was thinking along the lines of a subsearch, but as I said I haven't really looked at your question, so I'm not sure it would apply. My line of thinking, based on your first paragraph was;
The inner search would look at your rare events and return unique combinations of
Hope this helps at least a little bit.
Ok, so... The Subsearch works as per your example, but i want to pull some fields out of source A which are used in a table.
using your example:
obviously, adding 'username' to the fieldset for the subsearch results in the main search looking for matches on the username also (which will not exist in source B)
how can i get additional fields from the sub search to be available for post processing along with results from the main search?
answered 20 Mar '12, 07:46