Dashboards & Visualizations

selfjoin examples?

Communicator

Where can I find some examples of how selfjoin works -- input and output? I find this particular search command to be spectacularly under-explained.

Tags (1)

Builder

I haven't seen much about it in Splunk, but it looks like the standard SQL self-join, which is described in many blog posts. It's useful if you have a table with field values that refer to other keys in the same table. One example: http://www.sqltutorial.org/sqlselfjoin.aspx.