SQL to CQL: Subqueries

SQL subqueries can be nested within the primary query. In LogScale, saved queries and the let statement provide similar functionality.

SQL CQL
sql
SELECT hostname FROM endpoints 
WHERE hostname IN (
  SELECT distinct hostname FROM alerts 
  WHERE severity = 'critical' AND resolved = false
);

Using saved query approach:

logscale
let criticalHosts = severity="critical" resolved=false 
| distinct(hostname);
hostname in $criticalHosts