...
Run a Python script or a jar file within an action node. This operator is similar to callScript in that it allows for custom programming on the data. It is different from callScript in that this operator is invoked once for the entire data set in the input tables and therefore has information on all the rows in the input data to work with at once.
Operator Usage in Easy Mode
- Click + on the parent node.
- Enter the Call Script With Table operator in the search field and select the operator from the Results to open the operator form.
- In the Input Table drop-down, enter or select the table containing the data to run this operator on.
- In the Script Name drop-down, select the name of the script.
- Click Run to view the result.
- Click Save to add the operator to the playbook.
- Click Cancel to discard the operator form.
Usage Details
LQL Command
Code Block |
---|
callScriptWithTable(parent_table_name, script_name) |
...
Correlations are not preserved between the input and output of
callScriptWithTable()
. One of the consequences is that outputtinglhub_id
is redundant. There is no need to have anlhub_id
column in the output table. The system generates new randomlhub_id
values for each row. Correlation downstream will still be done provided that downstream operators support correlation.lhub_id
is a special internal column name.
Example 1
Test return
sourceIP | sourcePort | destIP | destPort |
---|---|---|---|
1 | 2 | 3 | 4 |
...
col1 | col2 | col3 |
---|---|---|
cell 1 3 | ||
cell 2 2 | ||
cell 3 1 |
Example 2
Use the following Python script to access the data from a table.
...