...
This operator is not a generic operator that works on any type of a data. It uses specific data (table) that is generated by the baseline playbook.
Operator Usage in Easy Mode
- Click + on the parent node.
- Enter Filter Baseline Table operator in the search field and select the operator from the Results to open the operator form.
In the Select Baseline drop-down, enter or select the baseline to pull data from.
Optional fields
- Start Time: Enter an offset time or a specific start time to pull the data from. Offset time allows
you to set time in seconds, minutes, hours, days, or weeks; Specific time allows you to select the
date and time. End Time: Enter an offset time or a specific end time to pull the data from. Offset time allows you
to set time in seconds, minutes, hours, days, or weeks; Specific time allows you to select the date
and time.Click Run to view the result.
- Click Save to add the operator to the playbook.
- Click Cancel to discard the operator form.
Usage Details
LQL Command
Code Block |
---|
filterBaselineTable(baselineTable, n) -- read last n batches filterBaselineTable(baselineTabel, a, b) -- read batches that fall between a, b. Both a and b batches inclusive |
Example
Input
'table': github_logs
...