![]() The right alias must be used together with the left alias. Must be combined with the left alias and the where clause, or the alias is ignored. right alias Syntax: right= Description: The alias to use with the right-side dataset to avoid naming collisions. The left alias must be used together with the right alias. Must be combined with the right alias and where clause, or the alias is ignored. left alias Syntax: left= Description: The alias to use with the left-side dataset, the source data, to avoid naming collisions. If no fields are specified, all of the fields that are common to both datasets are used. If is specified, one or more of the fields must be common to each dataset. For example, to join fields ProductA, ProductB, and ProductC, you would specify | join ProductA ProductB ProductC. ![]() Description: Specify the list of fields to use for the join. See Descriptions for the join-options argument in this topic. Use either outer or left to specify a left outer join. Optional arguments join-options Syntax: type=(inner | outer | left) | usetime= | earlier= | overwrite= | max= Description: Arguments to the join command. When is used in a search by itself with no join keys, the Splunk software autodetects common fields and combines the search results before the join command with the results of the subsearch. ![]() You can use either : or in a search, but not both. The results of the subsearch should not exceed available memory. The subsearch must be enclosed in square brackets. subsearch Syntax: Description: A secondary search or dataset that specifies the source of the events that you want to join to. You can use either : or with the join command, but not both. For example, if the dataset name is january and the dataset type is datamodel, you specify datamodel:january. The dataset name must follow the dataset type. The dataset must be a dataset that you created or are authorized to use. dataset-name Syntax: Description: The name of the dataset that you want to use to join with the source data. The dataset type must precede the dataset name. You can specify datamodel, savedsearch, or inputlookup. : | Required arguments dataset-type Syntax: datamodel | savedsearch | inputlookup Description: The type of dataset that you want to use to join with the source data.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |