Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

This operator is not a generic operator that works on any type of a data. It uses specific data (table) that is generated by the baseline playbook.

Operator Usage in Easy Mode

  1. Click + on the parent node.
  2. Enter Filter Baseline Table operator in the search field and select the operator from the Results to open the operator form.
  3. In the Select Baseline drop-down, enter or select the baseline to pull data from.

  4. Optional fields

  5. Start Time: Enter an offset time or a specific start time to pull the data from. Offset time allows
    you to set time in seconds, minutes, hours, days, or weeks; Specific time allows you to select the
    date and time.
  6. End Time: Enter an offset time or a specific end time to pull the data from. Offset time allows you
    to set time in seconds, minutes, hours, days, or weeks; Specific time allows you to select the date
    and time.

  7. Click Run to view the result.

  8. Click Save to add the operator to the playbook.
  9. Click Cancel to discard the operator form.

Usage Details

LQL Command

Code Block
filterBaselineTable(baselineTable, n) -- read last n batches
filterBaselineTable(baselineTabel, a, b) -- read batches that fall between a, b. Both a and b batches inclusive

Example

Input
'table': github_logs

...