joinΒΆ

The join command performs inner join operation: it appends the columns of the stream specified in the argument to the columns of its input stream by evaluating the join-condition. Only the records where join-condition evaluates to true will be included in the result set:

join( {'@'stream_ref | '@' '[' results_file ']' | '@' '[' script_file ']'}
      [AS alias] ON join_condition )

join_condition:
field_from_left_side_data = field_from_right_side_data [ {AND | OR} boolean_expr ,... ]

Note

When the field names for joining are same then the join condition can be expressed simply as field name: leftjoin(@stream_ref ON field_name)

Note

Assigning alias is optional. When it is omitted then:

  • default aliases are assigned to the left and right streams: left and right respectively.
  • fields with matching names in joined sets will be renamed by prepending left_ or right_ to field name respectively
  • fields with different names remain the same in the resultset

Example:

1
2
3
4
5
@ipaddr = dual(5) | select(sequence:i, ip);

@macaddr = dual(5) | select(sequence, mac:m);

@macaddr | join(@ipaddr on left.sequence = right.sequence);
where in the line:
  1. we declare a stream of 5 records with sequence and IP-address
  2. line 3 we declare another stream of 5 records with sequence and mac-address
  3. line 5 we join the two streams