Joins: Inner, Outer and none
Prev
Next

Joins: Inner, Outer and none

By default, Rekall creates queries over multiple tables using inner joins. However, you can change the join type between two tables to either right outer or lft outer by right-clicking on the link. This brings up a dialog box as shown below:



This dialog can also be used to delete a join. Note that if you attempt to save a query which has tables that are not connected, then Rekall will warn you and ask if the query should be saved anyway. You might want to do this if you really do want the query to return all row combinations from two (or more) queries, or it may be that the join condition is much more complicated and is defined as an explicit where expression (but if this is the case, Rekall cannot deduce any structure and queries will always be executed "flat" [26]).



[26] A future feature is to allow an arbitrary expression to be associated with a link; this will provide the best of both worlds.

Prev
Next
Home