Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Run a Python script or a jar file within an action node. This operator is similar to callScript in that it allows for custom programming on the data. It is different from callScript in that this operator is invoked once for the entire data set in the input tables and therefore has information on all the rows in the input data to work with at once.

Operator Usage in Easy Mode

  1. Click + on the parent node.
  2. Enter the Call Script With Table operator in the search field and select the operator from the Results to open the operator form.
  3. In the Input Table drop-down, enter or select the table containing the data to run this operator on.
  4. In the Script Name drop-down, select the name of the script.
  5. Click Run to view the result.
  6. Click Save to add the operator to the playbook.
  7. Click Cancel to discard the operator form.

Usage Details

LQL Command

Code Block
callScriptWithTable(parent_table_name, script_name)

...

  • Correlations are not preserved between the input and output of callScriptWithTable(). One of the consequences is that outputting lhub_id is redundant. There is no need to have an lhub_id column in the output table. The system generates new random lhub_id values for each row. Correlation downstream will still be done provided that downstream operators support correlation.

  • lhub_id is a special internal column name.

Example 1

Test return

sourceIPsourcePortdestIPdestPort
1234

...

col1col2col3
cell 1 3
cell 2 2
cell 3 1

Example 2

Use the following Python script to access the data from a table.

...