Return results when JOIN does not exist


1 comment

  • Avatar
    Duc Ha
    Have you considered the "transaction" operator? Alternatively, If you only deal with 2 states, then this hack might do the trick, assuming the two states have distinctive patterns: .. | parse " * *" as state1,user nodrop | parse " * *" as state2,user | first(state1) as FirstState1,first(state2) as FirstState2 by user | where !isNull(FirstState1) and isNull(FirstState2)
    Comment actions Permalink

Please sign in to leave a comment.