As a workaround, can you try the following from every e1 = inputstream -> e2 = inputstream[(e2.address != e1.address) and (e2.cardNum == e1.cardNum)] select e1.cardNum, e1.address as add1, e2.address as add2 insert into pairCountStream
from pairCountStream#window.time(10 mins) select cardNum, count(cardNum) as counter, add1, add2 group by cardNum insert into countCheckStream from countCheckStream[counter>2] select cardNum, add1, add2, counter insert into FraudAlert I dont think this is a very good method since there can be false positives, but try and see whether this works for you. On Fri, Oct 31, 2014 at 3:59 PM, Supun Muthutantrige <[email protected]> wrote: > One such scenario is, shipping to multiple addresses using a single credit > card. The merchant should be able to set a max no of addresses. So when the > no increases, query become complicated. > > Let's assume all the following transactions have the same credit card no, > but with different addresses and the max address count is 2. I have only > included the addresses > > 1. Colombo > 2. Kandy > 3. Colombo > 4. Kandy > 5. Matara > 6. Kandy > 7. Colombo > > Here according to the allowed address count, the 5th transaction should be > fraudulent (which is addressed to Matara) and all the other transactions > done from there after should also be fraudulent as well (6,7). This can be > captured from using what Rajeev has mentioned. But as I mentioned earlier, > when the max address count increases, using that query would get > complicated. > > So wanted to know how to scale by using counting patterns accordingly. > > Thank you > Regards > > *Supun Rasitha Muthutantrige* > Software Engineer | Intern > WSO2 Inc: http://wso2.com > lean.enterprise.middleware > Mobile: 0758374608 >
_______________________________________________ Dev mailing list [email protected] http://wso2.org/cgi-bin/mailman/listinfo/dev
