follow [frame(...)]?, [predicate: bool]+

Returns rows from the joined dataset (the single additional dataset referenced in the predicates) where the join condition matches at least one row from the primary input at some time within the query window, using a non-temporal semijoin that projects the right-hand side.

The output row type matches the joined dataset: no columns are added from the default input. Predicate arguments must be boolean expressions; if you pass several, they are combined with logical and. Together they must reference exactly one additional dataset (for example via @other.column). Window functions are not allowed in these predicates—compute them in an upstream stage and reference the result here.

Without frame(), the right-hand side is restricted to the query window and treated as non-temporal for the join, and the result is typically not accelerable. With frame(back: …, ahead: …) from frame (using back and ahead, not start or end), both inputs must be temporal (Event, Interval, or Resource); this enables accelerable matching when the predicates themselves are accelerable. If a non-accelerable function appears inside the predicate, acceleration is disabled.

To keep matching rows from the default input instead, use exists. For rows on the default input with no match, see not_exists. For rows on the joined dataset with no match, see follow_not. For a full relational join that adds columns, see join or leftjoin.

Categories

• Join

Accelerable

follow is accelerable if there is a frame() argument. A dataset that only uses accelerable verbs can be accelerated, making queries on the dataset respond faster.

Examples

follow user_id=@audit.user_id

Returns audit rows whose user_id lines up with some session row in the query window, without projecting columns from the sessions dataset.

follow frame(back:1h, ahead:1h), host=@metrics.host AND env=@metrics.env

Uses a temporal frame so a metric row is emitted when a deployment with the same host and env overlaps the band around the metric’s timestamp.

follow sku=@catalog.sku, region=@catalog.region

Combines two boolean predicates (implicitly ANDed) so both SKU and region must match an order row for the catalog row to appear in the result.