Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Table of Contents
minLevel1
maxLevel6
outlinefalse
typeflat
printablefalse

Join two tables (left, right) basd on a matching input field (left.inputField = right.lookupField) and add a fetchField column to the first (left) table. This operator is useful if the input table has numerous columns, which can make it difficult to use a simple join.

...

Input
table A with (f1, f2, f3) columns,

sourceIP

sourcePort

destIP

destPort

1

2

3

4

LQL command

Code Block
B = select f1 as u1, SIZE(f2) + SIZE(f3) as val from A
C = lookupOperator(A,"f1", B, "u1", "val")

-- C should be a table A with additional "val" column

-- The operator should produce the same output as
-- select f1, f2, f3, val from A join B on A.f1 = B.u1

...