Using metadata in `on` clause for `join

Follow

Alhad Palkar

• November 04, 2016 18:38

I am trying to perform a join on two log events if they come from the same _sourceHost. There is nothing else in the two events that i can perform a join on. How would I do this? If I do on x._sourceHost = y._sourceHost it gives me me this error "x__sourceHost in the condition cannot be found in subqueries."

0

• 

  Tommy Pensyl

  • August 12, 2020 13:02
  • Edited

  I found by mapping _sourceHost to another variable as such
  
  join (parse "my message [*]" as z | _sourceHost as a) as x, ....
  
  Then I was able to reference the sourcehost as x_a

  0

  Comment actions Permalink

Please sign in to leave a comment.