Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Table of Contents
minLevel1
maxLevel6
outlinefalse
typeflat
printablefalse

Operator Usage in Easy Mode

  1. Click + on the parent node.
  2. Enter the Multi Lookup operator in the search field and select the operator from the Results to open the operator form.
  3. In the Input Table drop-down, enter or select the name of the table to run this operator on.
  4. In the Lookup Fields drop-down, enter or select the name of the column that exists in both tables for matching.
  5. In the Lookup Table drop-down, enter or select the name of the lookup table.
  6. In the Fetch Fields drop-down, enter or select the name of the column in the lookup table to add to the input table.
  7. Click Run to view the result.
  8. Click Save to add the operator to the playbook.
  9. Click Cancel to discard the operator form.

Usage Details

This operator left joins two tables (left, right) on left.lookupFields = right.lookupFields and adds fetchFields column to the left table.

...

Returns:
The output table is the same as input table with an additional columns named in fetchField. If fetchField column already exists in input table the original one is dropped.

Example

LQL command

Code Block
B = select cast(rand()*5 as int) as A, cast(rand()*5 as int) as B, cast(rand()*5 as int) as C from syslog
A = select cast(rand()*5 as int) as A, cast(rand()*5 as int) as B from syslog limit 2
C = multiLookup(A, ["A", "B"], B, ["C"])

...