Join Query Functions
LogScale's join functions enable you to join data from one or more
repositories or views into a single table. For more information, see
join() Syntax.
Table: Join Query Functions
| Function | Default Argument | Availability | Description |
|---|---|---|---|
defineTable([end], include, name, query, [start], [view]) | name | introduced in 1.163.0 | Runs a subquery to generate an in-memory table, then the table results are passed to a primary query to perform join-like operations. |
join([end], field, [include], [key], [limit], [live], [max], [mode], query, [repo], [start], [view]) | query | Join two LogScale searches. | |
selfJoin([collect], field, [limit], [postfilter], [prefilter], [select], where) | field | Used to collate data from events that share a key. | |
selfJoinFilter(field, [prefilter], where) | field | Runs query to determine IDs, and then gets all events containing one of them. |