Using join

People with experience in Structured Query Language (SQL) will be familiar with the concept of a join. You can use the join command to join the results of the subsearch to your main search results. As part of the join command, you will want to identify a field to join on. Again, the basic syntax is simple:

SPL> . . | join field_name [subsearch]

This will default to an inner join, which includes only events shared in common by the two searches. You can also specify an outer or left join. The outer join contains all the data from both searches, whereas the left join contains the data from events fulfilling main search, as well as the events that are shared in common.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.137.218.215