You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/user/admin/settings.rst
+1-13Lines changed: 1 addition & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -792,16 +792,4 @@ If Calcite pushdown optimization is enabled, this setting is used to estimate th
792
792
793
793
1. The default value is 0.9 since 3.1.0.
794
794
2. This setting is node scope.
795
-
3. This setting can be updated dynamically.
796
-
797
-
plugins.ppl.spl_compatible.enabled
798
-
==================================
799
-
800
-
Description
801
-
-----------
802
-
803
-
This setting is present from 3.2.0. Enabling Calcite is a prerequisite. You can use this setting to decide whether to allow parsing a query of Splunk SPL compatible grammar.
Copy file name to clipboardExpand all lines: docs/user/ppl/admin/settings.rst
-32Lines changed: 0 additions & 32 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -89,38 +89,6 @@ PPL query::
89
89
"transient": {}
90
90
}
91
91
92
-
plugins.ppl.spl_compatible.enabled
93
-
==================================
94
-
95
-
Description
96
-
-----------
97
-
98
-
This setting is present from 3.2.0. Enabling Calcite is a prerequisite. You can use this setting to decide whether to allow parsing a query of Splunk SPL compatible grammar.
Copy file name to clipboardExpand all lines: docs/user/ppl/cmd/join.rst
+15-16Lines changed: 15 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,39 +11,35 @@ join
11
11
12
12
Description
13
13
===========
14
-
|(Experimental)
15
-
|(Since 3.0.0)
16
14
|Using ``join`` command to combines two datasets together. The left side could be an index or results from a piped commands, the right side could be either an index or a subsearch.
17
15
18
16
Version
19
17
=======
20
18
3.0.0
21
19
22
-
Syntax
23
-
======
24
-
[joinType] join [leftAlias] [rightAlias] on <joinCriteria> <right-dataset>
20
+
Syntax-1
21
+
========
22
+
|[joinType] join [leftAlias] [rightAlias] on <joinCriteria> <right-dataset>
25
23
26
24
* joinType: optional. The type of join to perform. The default is ``INNER`` if not specified. Other option is ``LEFT [OUTER]``, ``RIGHT [OUTER]``, ``FULL [OUTER]``, ``CROSS``, ``[LEFT] SEMI``, ``[LEFT] ANTI``.
27
25
* leftAlias: optional. The subsearch alias to use with the left join side, to avoid ambiguous naming. Fixed pattern: ``left = <leftAlias>``
28
26
* rightAlias: optional. The subsearch alias to use with the right join side, to avoid ambiguous naming. Fixed pattern: ``right = <rightAlias>``
29
27
* joinCriteria: mandatory. It could be any comparison expression.
30
-
* right-dataset: mandatory. Right dataset could be either an index or a subsearch with/without alias.
28
+
* right-dataset: mandatory. Right dataset could be either an ``index`` or a ``subsearch`` with/without alias.
* type=<joinType>: optional. The type of join to perform. The default is ``INNER`` if not specified. Other option is ``LEFT``, ``RIGHT``, ``FULL``, ``CROSS``, ``SEMI``, ``ANTI``.
40
36
* overwrite=<bool>: optional. Specifies whether duplicate-named fields from <right-dataset> (subsearch results) should replace corresponding fields in the main search results. The default value is ``true``.
41
37
* join-field-list: optional. The fields to use to build join criteria. The ``join-field-list`` must be present in both sides. If no <join-field-list> is present, all fields that are common to both sides are used.
42
-
* right-dataset: mandatory. Right dataset could be either an index or a subsearch with/without alias.
38
+
* right-dataset: mandatory. Right dataset could be either an ``index`` or a ``subsearch`` with/without alias.
43
39
44
40
Configuration
45
41
=============
46
-
This command requires Calcite enabled. In 3.0.0-beta, as an experimental the Calcite configuration is disabled by default.
42
+
This command requires Calcite enabled. In 3.0.0, as an experimental the Calcite configuration is disabled by default.
47
43
48
44
Enable Calcite::
49
45
@@ -70,7 +66,7 @@ Result set::
70
66
Usage
71
67
=====
72
68
73
-
Join::
69
+
Join (syntax-1)::
74
70
75
71
source = table1 | inner join left = l right = r on l.a = r.a table2 | fields l.a, r.a, b, c
76
72
source = table1 | left join left = l right = r on l.a = r.a table2 | fields l.a, r.a, b, c
@@ -85,6 +81,9 @@ Join::
85
81
source = table1 as t1 | join left = l right = r on l.a = r.a table2 as t2 | fields l.a, r.a
86
82
source = table1 as t1 | join left = l right = r on l.a = r.a table2 as t2 | fields t1.a, t2.a
87
83
source = table1 | join left = l right = r on l.a = r.a [ source = table2 ] as s | fields l.a, s.a
84
+
85
+
Join (syntax-2)::
86
+
88
87
source = table1 | join a table2 | fields a, b, c
89
88
source = table1 | join a, b table2 | fields a, b, c
90
89
source = table1 | join type=left overwrite=false a, b [source=table2 | rename d as b] | fields a, b, c
@@ -158,7 +157,7 @@ PPL query::
158
157
159
158
Limitation
160
159
==========
161
-
If fields in the left outputs and right outputs have the same name. Typically, in the join criteria
160
+
In syntax-1, if fields in the left outputs and right outputs have the same name. Typically, in the join criteria
162
161
``ON t1.id = t2.id``, the names ``id`` in output are ambiguous. To avoid ambiguous, the ambiguous
163
162
fields in output rename to ``<alias>.id``, or else ``<tableName>.id`` if no alias existing.
164
163
@@ -179,4 +178,4 @@ Assume table1 and table2 only contain field ``id``, following PPL queries and th
179
178
* - source=table1 | join right=tt on table1.id=t2.id [ source=table2 as t2 | eval b = id ] | eval a = 1
180
179
- table1.id, tt.id, tt.b, a
181
180
182
-
For the Splunk SPL compatible syntax (since 3.2.0), duplicate-named fields in output results are deduplicated, with field retention determined by the value of 'overwrite' option.
181
+
But for the syntax-2 (since 3.2.0), duplicate-named fields in output results are deduplicated, with field retention determined by the value of 'overwrite' option.
0 commit comments