zui
zui copied to clipboard
Incorrect "Pivot to logs" for table of upper-level records
Repro is with Brim commit 0e72930
.
Consider the following query output after importing wrccdc.2018-03-23.010014000000000.pcap.gz:
If I right-click on the top row and select "Pivot to logs", the rewritten query does not correctly isolate the 4 events I was seeking.
This is not a problem with fully-referenced bottom-level record fields.
I originally spotted this symptom in the context of working with the new geo.
records, but turns out this problem has been with us from before that.