The selfJoin() function enables efficient collation of information within a repository by executing two queries and joining them on a common field, similar to a traditional join operation but specifically designed for shared command fields. Through practical examples using connection data with source and destination addresses, the documentation demonstrates how selfJoin() can effectively summarize information across connection IDs, offering better performance than groupBy() for larger datasets.

The selfJoin() function does not perform a join in the traditional sense, but is designed to collate information from a repository within a query where they share a command field.

selfJoin() executes two queries, the primary query and subquery, and joins on a common field (specified by the field parameter) between the two queries in a similar fashion to join().

For example, given input data the includes the source and destination address for connections and a common connection ID:

The following query will summarize the information for source and destination across the connection ID:

selfJoin(field=connid,where=[{from="192.168.1.7"},{to="10.0.0.12"}])

This would output the following result:

This process can be more efficient than using a groupBy() for larger datasets.