documentationlookaround_join¶
Type of operation: Join
Description¶
Lookaround join is a type of inner join. Where this differs from “join” is that a row from the input dataset is matched only with rows from the other dataset that are within the specified timeframe around the input row. This join can only be used to join two event datasets.
The first argument “frame” specifies the timeframe. The “predicate” and “columnbinding” arguments work identically to that of a regular “join.”
Usage¶
lookaround_join frame [ , targetDataset ] [ , predicate ] ... [ , columnbinding ] ...
Argument |
Type |
Required |
Multiple |
|---|---|---|---|
frame |
frame |
Required |
Only one |
targetDataset |
datasetref |
Optional |
Only one |
predicate |
bool |
Optional |
Can be multiple |
columnbinding |
expression |
Optional |
Can be multiple |
Accelerable¶
lookaround_join is always accelerable if the input is accelerable. A dataset that only uses accelerable verbs can be accelerated, making queries on the dataset respond faster.
Examples¶
lookaround_join frame_exact(back: 2s, ahead: 2s), [email protected], location:@hostdata.location
For every row in the input dataset, fetch the rows from “host” that are exactly within 2s of the input row and matching the IP address. Extract the location field from the “hostdata” dataset. Consider using frame() instead of frame_exact() where possible, for faster execution.