Hi,
I need to Optimize my query to improve the dashboard performance without using any type of join function.
Below is my query
| inputlookup sample.csv
| search user IN ( ) application_name IN () "application id" IN (*)
|eval None="None"
| table "application id",application_name,user,"Status",Type,"Service Host",Platform,Jan,Feb,Mar,Apr,None,env
| rename "application_name" as Server_Name
| eval Server_Name=upper(Server_Name)
| join type=left Server_Name
[ search index=idx sourcetype=xyz
| eval Server_Name=upper(Server_Name)
| search Status!="Completed"
| table Server_Name Status]
| search Status!="Completed" | stats sum("Jan") as jan sum("Feb") as feb sum("Mar") as mar sum("Apr") as apr by env
| eval total = jan+feb + mar + apr
|table env total
Please help me to optimize this query without using join
UPDATED:
index=idx sourcetype=xyz Status="retain" OR Status="progress" Server_Name=*
| eval Server_Name=upper(Server_Name)
| table Server_Name Status
| dedup Server_Name
| lookup sample.csv "application_name" as Server_Name OUTPUTNEW
| eval None="None"
| where isnotnull(user)
| search user IN ( ) application_name IN () "application id" IN (*)
| stats sum("Jan") as jan sum("Feb") as feb sum("Mar") as mar sum("Apr") as apr by env
| eval total = jan+feb + mar + apr
| table env total
Hi, @avni26
some code is disappear.Status of Server_Name is latest status.
@to4kawa Thank you for your response.
I tried to execute like above, but why lookup fields giving multiple values in same row.
thanks,
| lookup sample.csv "application_name" as Server_Name OUTPUTNEW
Maybe, there is same Server_name.
| dedup Server_name
but, Status is unclear.
Status is coming from index having values like completed, retain, progress l