Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Operations

Syntax

Arguments

Lookup (lu)

lu(...)

(

Status
title"lookup_name"
,
Status
colourPurple
title"lookup_field"
,
Status
colourBlue
titlekey_field
)

Lookup (hlut)

hlut(...)

(

Status
title"lookup_name"
,
Status
colourPurple
title"lookup_field"
,
Status
colourBlue
titlekey_field
)

(

Status
title"lookup_name"
,
Status
colourPurple
title"lookup_field"
,
Status
colourBlue
titlekey_field
,
Status
colourGreen
titletimestamp_field
)

Lookup (hlurjson)

hlurjson(...)

(

Status
titlelookup_name
,
Status
colourBlue
titlekey_field
,
Status
colourGreen
titletimestamp_field
)

Info

Syntax special considerations

  • Status
    title"lookup_name"
    → This must be the name of lookup that contains the data you want to use to enrich your data.

  • Status
    colourPurple
    title"lookup_field"
    → This must be the lookup field you want to use to enrich your data, which must not be the same as the lookup key field.

  • Status
    colourBlue
    titlekey_field
    → This must be the table field that will be used to find matches with the lookup key. The name can be different than the lookup key field as long as the data type coincide and the values it contains are potential matches (username-user). The absence of matches will return null and a different data type will return an error when running the query .

  • Status
    colourGreen
    titletimestamp_field
    → This must be the table timestamp that will be used to correlate with the lookup timestamp. A data type other than timestamp will return an error when running the query.

One-field lookups

If your lookup is composed only of the key field because you are interested only in the correlation but not the enrichment, you need to use the operation Lookup (hlurjson).

As an alternative, you can use lookups with two fields; the key field and a field with default values such as true. You can use the Lookup (lu) operation to enrich your data with the default values that indicate only correlation.