Using multiple timeframes in a single query with lookups

[PiotrG]

Hey!

fetch dt.entity.host, from: now()-15m  //1
[...]
| lookup [ fetch events, from: now()-3h  //2
  ...]
| lookup [ timeframe, //3
  ...]
[rest of the main host query]

I'm wondering about the timeframes that would be used in this query.
1 is clear, I'm sure it will use last 15 minutes.
2 also seems clear, if it's alright to alter the timeframe within a lookup command
3 I'm not sure about, if no timeframe is provided in a lookup query does it inherit timeframe from the original query or will it use last set timeframe or is the behaviour completely different?
Thanks!

[sinisa_zubic · Accepted solution]

Hi @PiotrG 

I have just tried it out by executing following query:

fetch dt.entity.host, from:now() -15m
| fieldsAdd key = 1
| lookup [fetch events, from:now()-180m, to:now()-175m | fieldsAdd key=1 | sort timestamp asc | fields timestamp,key], sourceField:key, lookupField:key, prefix:"withTF."
| lookup [fetch events | fieldsAdd key=1 | sort timestamp asc | fields timestamp,key], sourceField:key, lookupField:key, prefix:"withoutTF."
| fields from= now()-15m, withTF.timestamp, withoutTF.timestamp

If you don't specify the TF in the lookup, then the TF is inherited from the original query.

Best,
Sini