Devo SOAR - multiLookup

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter the Multi Lookup operator in the search field and select the operator from the Results to open the operator form.
3. In the Input Table drop-down, enter or select the name of the table to run this operator on.
4. In the Lookup Fields drop-down, enter or select the name of the column that exists in both tables for matching.
5. In the Lookup Table drop-down, enter or select the name of the lookup table.
6. In the Fetch Fields drop-down, enter or select the name of the column in the lookup table to add to the input table.
7. Click Run to view the result.
8. Click Save to add the operator to the playbook.
9. Click Cancel to discard the operator form.

Usage Details

This operator left joins two tables (left, right) on left.lookupFields = right.lookupFields and adds fetchFields column to the left table.

LQL Command

multiLookup(table:TableReference, lookupFields:ColumnReference[], lookupTable:TableReference, fetchFields:ColumnReference[])

Parameters:
table (TableReference) - Input table
lookupFields (ColumnReference[]) - Column names that exist in both tables for matching
lookupTable (TableReference) - The name of the lookup table
fetchFields (ColumnReference[]) - Columns in lookup table to add to the input table

Returns:
The output table is the same as input table with an additional columns named in fetchField. If fetchField column already exists in input table the original one is dropped.

Example

LQL command

B = select cast(rand()*5 as int) as A, cast(rand()*5 as int) as B, cast(rand()*5 as int) as C from syslog
A = select cast(rand()*5 as int) as A, cast(rand()*5 as int) as B from syslog limit 2
C = multiLookup(A, ["A", "B"], B, ["C"])

Output
C table should be same as A table (2 rows) + "C" column which comes from B table.