join on(...), [columnbinding: expression]*

Temporal inner join, adding new columns in the output dataset.

Categories

• Join

Accelerable

join is always accelerable if the input is accelerable. A dataset that only uses accelerable verbs can be accelerated, making queries on the dataset respond faster.

Examples

join on(host_uid=@host.uid), hostname:@host.name

Temporal inner join with dataset 'host', and extract the 'name' column from that 'host' table, calling the new column 'hostname' in the output.

join on(timestamp <= @hostlogs.timestamp, frame(ahead:1s, back:1s)), hostlog:@hostlogs.log

Temporal inner join with dataset 'hostlogs', using frame to look 1 second ahead and 1 second behind the original timestamp. Logs from the hostlog dataset are extracted as a new column if their timestamp is less than or equal to the timestamp of this dataset's log. The new column is called 'hostlog' in the output.