Join Query Functions

LogScale's join functions enable you to join data from one or more repositories or views into a single table. For more information, see Query Joins.

Table: Join Query Functions

FunctionDefault ArgumentAvailabilityDescription
join([end], field, [include], [key], [limit], [live], [max], [mode], query, [repo], [start], [view])query  Join two LogScale searches.
selfJoin([collect], field, [limit], [postfilter], [prefilter], [select], where)field  Used to collate data from events that share a key.
selfJoinFilter(field, [prefilter], where)field  Runs query to determine IDs, and then gets all events containing one of them.