Versions Compared

Old Version 1

changes.mady.by.user Borja Moro Moreno

Saved on

compared with

New Version Current

changes.mady.by.user Borja Moro Moreno

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Table of Contents
minLevel1
maxLevel2minLevel1
outlinefalse
stylenone
typeflat
printabletrue

...

Select Create field in the search window toolbar, then select the Lookups category, and choose the Lookup (hlut) operation from the dropdown (more info here). You need to specify four arguments:

Argument

Description

Data type

Lookup name mandatory

Choose the lookup you want to use to enrich your table.

string

Lookup field mandatory

Choose the lookup field you want to use to enrich your table.

string

Key mandatory

Choose the table field you want to use to find matches with the lookup key field.

same as lookup key field

Time mandatory

Choose the table timestamp you want to use to correlate with the lookup timestamp. It identifies the value with the latest timestamp in the lookup before the timestamp in your table.

timestamp

...

  • select hlut("Lookup_name", "Lookup_field", Key_field) as new_field

  • select hlut("Lookup_name", "Lookup_field", Key_field, Timestamp_field) as new_field

Info

Syntax considerations

  • Status
    title"lookup_name"
    → This must be the name of lookup that contains the data you want to use to enrich your data.

  • Status
    colourPurple
    title"lookup_field"
    → This must be the lookup field you want to use to enrich your data, which must not be the same as the lookup key field.

  • Status
    colourBlue
    titlekey_field
    → This must be the table field that will be used to find matches with the lookup key. The name can be different than the lookup key field as long as the data type coincide and the values it contains are potential matches (username-user). The absence of matches will return null and a different data type will return an error when running the query.

  • Status
    colourGreen
    titletimestamp_field
    → This must be the table timestamp that will be used to correlate with the lookup timestamp. A data type other than timestamp will return an error when running the query.

Example

After performing the operations you need to manipulate your data, such as filtering and grouping operations, you can use the Lookup (hlut) operation to enrich your data with the following time range lookup:

...

These are the arguments needed when using the interface :

Code Block
Lookup name: Enrichment

...


Lookup field: username

...


Key: city

...


Time: eventdate

This is the syntax needed when using LINQ free-text query:

...