SELECT * from
( select *,
search(event_params, 'link_url') as link_url, #one column
SEARCH((event_params, user_properties), 'user_id') user_id_search, #multiple columns
SEARCH(
xxx.events_* , 'link_domain') link_domain #table scanfrom
xxx.events_* where _table_suffix >= '20220301'
) where user_id_search = true