lookaround_join

Type of operation: Join

Description

Lookaround join is a type of inner join. Where this differs from “join” is that a row from the input dataset is matched only with rows from the other dataset that are within the specified timeframe around the input row. This join can only be used to join two event datasets.

The first argument “frame” specifies the timeframe. The “predicate” and “columnbinding” arguments work identically to that of a regular “join.”

Usage

lookaround_join frame [ , targetDataset ] [ , predicate ] ... [ , columnbinding ] ...

Argument

Type

Required

Multiple

frame

frame

Required

Only one

targetDataset

datasetref

Optional

Only one

predicate

bool

Optional

Can be multiple

columnbinding

expression

Optional

Can be multiple

Accelerable

lookaround_join is always accelerable if the input is accelerable. A dataset that only uses accelerable verbs, can be accelerated, making queries on the dataset respond faster.

Examples

lookaround_join frame_exact(back: 2s, ahead: 2s), [email protected], location:@hostdata.location

For every row in the input dataset, fetch the rows from “host” that are exactly within 2s of the input row and matching the IP address. Extract the location field from the “hostdata” dataset. Consider using frame() instead of frame_exact() where possible, for faster execution.