follow_not [frame(...)]?, [predicate: bool]+

Returns rows from the joined dataset (the single additional dataset referenced in the predicates) where the join condition matches no row from the primary input at any time within the query window, using a non-temporal left anti-semijoin that projects the right-hand side.

The output row type matches the joined dataset. Predicate arguments must be boolean expressions; if you pass several, they are combined with logical and. Together they must reference exactly one additional dataset (for example via @other.column). Window functions are not allowed in these predicates—compute them in an upstream stage and reference the result here.

Without frame(), the right-hand side is restricted to the query window and treated as non-temporal for the join, and the result is typically not accelerable. With frame(back: …, ahead: …) from frame (using back and ahead, not start or end), both inputs must be temporal (Event, Interval, or Resource); this enables accelerable matching when the predicates themselves are accelerable. If a non-accelerable function appears inside the predicate, acceleration is disabled.

For the positive match on the joined dataset, see follow. To drop matching rows from the default input instead, use not_exists. For matching rows from the default input, use exists. For joins that add columns, see join or leftjoin.

Categories

• Join

Accelerable

follow_not is accelerable if there is a frame() argument. A dataset that only uses accelerable verbs can be accelerated, making queries on the dataset respond faster.

Examples

follow_not user_id=@audit.user_id

Keeps audit events whose user_id never appears on the sessions dataset anywhere in the query window.

follow_not frame(back:30m, ahead:30m), trace_id=@errors.trace_id

Temporal follow_not keeps trace rows that have no error with the same trace id within the specified lookback and lookahead window.