Table of Contents | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
|
Join two tables (left, right) basd on a matching input field (left.inputField
= right.lookupField
) and add a fetchField
column to the first (left) table. This operator is useful if the input table has numerous columns, which can make it difficult to use a simple join.
...
Input
table A with (f1, f2, f3) columns,
sourceIP | sourcePort | destIP | destPort |
---|---|---|---|
1 | 2 | 3 | 4 |
LQL command
Code Block |
---|
B = select f1 as u1, SIZE(f2) + SIZE(f3) as val from A C = lookupOperator(A,"f1", B, "u1", "val") -- C should be a table A with additional "val" column -- The operator should produce the same output as -- select f1, f2, f3, val from A join B on A.f1 = B.u1 |
...