Slackbot
03/15/2023, 9:43 PMJohn Kowtko
03/15/2023, 10:01 PMinsert into ds2
select floor(__time to HOUR) as __time,
emailid,
count(distinct tmp_hash) as num_hashes
from ds1
group by 1, 2
partitioned by HOUR
The ingestion shouldn't care about the segment granularity of ds1, it is only source data.
Let me know if that doesn't do what you want.khajjiar trip
03/15/2023, 10:09 PMObject 'ds2' not foundkhajjiar trip
03/15/2023, 10:10 PMVijay Narayanan
03/15/2023, 10:57 PMJohn Kowtko
03/16/2023, 1:37 AMkhajjiar trip
03/16/2023, 3:37 AM{
"queryType": "topN",
"dataSource": {
"type": "join",
"left": "myDataSource",
"right": {
"type": "query",
"query": {
"queryType": "topN",
"dataSource": "myDataSource",
"dimension": "emailid",
"threshold": 50000,
"granularity": "all",
"filter": {},
"aggregations": [
{
"type": "HLLSketchBuild",
"name": "dev_hash_chg_freq",
"fieldName": "dev_hash",
"lgK": 12,
"tgtHllType": "HLL_4",
"round": true
}
],
"metric": {
"type": "numeric",
"metric": "dev_hash_chg_freq"
},
"intervals": []
}
},
"rightPrefix": "b.",
"condition": "emailid == \"b.emailid\"",
"joinType": "INNER"
},
"virtualColumns": [],
"dimension": {
"type": "default",
"dimension": "host",
"outputName": "host",
"outputType": "STRING"
},
"metric": {
"type": "numeric",
"metric": "totalcount"
},
"intervals": {
"type": "intervals",
"intervals": []
},
"filter": {},
"granularity": "all",
"aggregations": [
{
"type": "filtered",
"aggregator": {
"type": "count",
"name": "totalcount"
},
"filter": {},
"name": "totalcount"
}
],
"context": {},
"descending": false,
"threshold": 10
}khajjiar trip
03/16/2023, 3:38 AMemail1 32
email1 has 32 unique dev_hashes in the last hour
instead of the following as that would again need an aggregate.
email1. AHeee
email1 AHfffVijay Narayanan
03/16/2023, 4:13 AMkhajjiar trip
03/16/2023, 4:15 AMselect count(*), a.host from myDatasource a inner join (
select emailid, APPROX_COUNT_DISTINCT_DS_HLL(dev_hash, 12, 'HLL_4') from myDatasource
where "__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00'
group by emailid
order by 2 desc
limit 50000
) b
on a.emailid=b.emailid
where
"__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00'
GROUP BY a.hostkhajjiar trip
03/16/2023, 4:20 AMVijay Narayanan
03/16/2023, 4:40 AMselect count(*), a.host,a.emailid from myDatasource a inner join (
select emailid, APPROX_COUNT_DISTINCT_DS_HLL(dev_hash, 12, 'HLL_4') from myDatasource
where "__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00'
group by emailid
order by 2 desc
limit 50000
) b
on a.emailid=b.emailid
where
"__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00'
GROUP BY a.hostVijay Narayanan
03/16/2023, 4:41 AMkhajjiar trip
03/16/2023, 4:43 AMVijay Narayanan
03/16/2023, 4:43 AMVijay Narayanan
03/16/2023, 4:45 AMselect emailid, APPROX_COUNT_DISTINCT_DS_HLL(dev_hash, 12, 'HLL_4') from myDatasource
where "__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00'
group by emailid
order by 2 desc
limit 50000
take?khajjiar trip
03/16/2023, 4:49 AMVijay Narayanan
03/16/2023, 4:53 AMkhajjiar trip
03/16/2023, 4:54 AMVijay Narayanan
03/16/2023, 4:59 AMVijay Narayanan
03/16/2023, 5:00 AMkhajjiar trip
03/16/2023, 5:03 AMselect count(*), a.host from myDatasource a inner join (
select emailid, APPROX_COUNT_DISTINCT_DS_HLL(dev_hash, 12, 'HLL_4') dev_hash_count from myDatasource
where "__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00'
group by emailid
order by 2 desc
limit 50000
) b
on a.emailid=b.emailid
where
"__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00' AND b.dev_hash_count > 20
GROUP BY a.hostkhajjiar trip
03/16/2023, 5:05 AMVijay Narayanan
03/16/2023, 5:07 AMselect a.host,sum(total) from (select count(*) total, host,emailid from myDatasource group by emailid,host) a inner join (
select emailid, APPROX_COUNT_DISTINCT_DS_HLL(dev_hash, 12, 'HLL_4') dev_hash_count from myDatasource from myDatasource
where "__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00'
group by emailid
order by 2 desc
limit 50000
) b
on a.emailid=b.emailid
where
"__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00'
AND b.dev_hash_count > 20
GROUP BY a.host
I have re-written to aggregtae the left table first before the joinVijay Narayanan
03/16/2023, 5:09 AMVijay Narayanan
03/16/2023, 5:14 AMVijay Narayanan
03/16/2023, 5:18 AMselect a.host,sum(total) from (select count(*) total, host,emailid from myDatasource
where "__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00' group by emailid,host) a inner join (
select emailid, APPROX_COUNT_DISTINCT_DS_HLL(dev_hash, 12, 'HLL_4') dev_hash_count from myDatasource from myDatasource
where "__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00'
group by emailid
order by 2 desc
limit 50000
) b
on a.emailid=b.emailid
where
"__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00'
AND b.dev_hash_count > 20
GROUP BY a.hostVijay Narayanan
03/16/2023, 5:23 AMselect a.host,sum(total) from (select count(*) total, host,emailid from myDatasource
where "__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00' group by emailid,host) a inner join (
select emailid, APPROX_COUNT_DISTINCT_DS_HLL(dev_hash, 12, 'HLL_4') dev_hash_count from myDatasource from myDatasource
where "__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00'
group by emailid
order by 2 desc
limit 50000 having dev_hash>20
) b
on a.emailid=b.emailid
where
"__time" BETWEEN TIMESTAMP '2023-03-06 07:10:00' AND TIMESTAMP '2023-03-06 11:11:00'
GROUP BY a.hostkhajjiar trip
03/16/2023, 5:27 PM