map
Use the map
command to join a view that was created using
the createview
command, with the groups identified by the
link
command to create new properties.
Syntax
map <subquery> using <view_name>
Parameters
The following table lists the parameters used in this command, along with their descriptions.
Parameter | Description |
---|---|
|
The subquery to describe the new properties to associate with the groups. It has two parts:
|
view_name |
The name of the view to use in the
|
For examples of using this command in typical scenarios, see:
The following command creates a property to mark all the entity groups with application error:
* | link Entity, Label
| createview [
* | where Label = 'Application Error'
| rename Entity as 'Application Error Entity'
] as 'Application Error View'
| map [ * | where Entity = 'Application Error Entity'
| eval 'Has Issue' = Yes
] using 'Application Error View'