Document toolboxDocument toolbox

Data table

Owned by Juan Tomás Alonso Nieto (Deactivated)
Last updated: Aug 06, 2024
4 min read
[ 1 About the data table ] [ 2 Data table shortcuts ]

About the data table

In the data table, each row represents an event and each field represents a data value correctly recognized by Devo. If the data is not separated in several fields or is shown in the unknown tag structure of the search view, it is normally due to missing or incorrect tags. Learn more about tags in this article.

The data displayed in the table will change according to the operations you apply to build your query (filters, new fields...). Learn more about building queries here.

Data table shortcuts

command (MAC) / CTRL (Windows) + enter

3_data table.png
Accessing data table
6_data table.png
Equivalent run button

Access data table through free text query

When you are writing your query in the Free text query section (Data search → Explore your data → Free text query), use this shortcut to launch the query and open the corresponding data table (more info here).

Equivalent run button

You can also click the Run query button to launch the query and open the corresponding data table. Hovering over the Run button will reveal a tooltip with the shortcuts.

select row + space bar

Open event details

Click one row to select an event and use this shortcut to open the Selected events window. Hold command (MAC) or control (Windows) while clicking rows to select several events.

  1. Rich views: this toggle change the way JSON fields are displayed, switching between hierarchy-based and plain (see picture on the left).

  2. Navigation: these buttons allow you to navigate the different events when several are selected on the table.

  3. Format: select the type of file to download the content (csv, json, or txt).

  4. Copy: this button is used to copy the content to your clipboard.

  5. Download: this button is used to perform the download in the specified format.

  6. Details: these are the fields that conforms the event, with their values and data types.

Equivalent toolbar button

You can also select the required event(s) and click the Selected events icon in the search window toolbar to open the Selected events window.

SELECT cell + enter

Filter data using a cell’s value

You can click a value in your table to select it and hit the enter key to apply a filter and get only events with that specific value in that field.

The Operations over fields window will be open in the Filter tab, the Equal (eq, =) operation selected, and the arguments automatically selected. You only need to click Filter to apply it.

Equivalent toolbar button

You can also click the Filter button on the toolbar, however, you need to manually select operation and arguments.

SELECT cell + p

Open cell details (any data type)

Select a cell in your data table and hit the p key to open a window displaying the cell content. This feature becomes particularly useful when a cell's content is significantly long and cannot fit within the cell, even after resizing. You can copy the whole cell content using the Copy to clipboard button.

Open cell details (JSON data type)

When the cell contains data in JSON format, this window becomes particularly useful, as it displays content in a reader-friendly way. Field/value pairs are shown on separate lines and values are color-coded by data type. Learn more about this in Working with JSON objects in data tables.

Equivalent right-click option

You can also right-click the cell in question and select Pretty print to open the selected cell window.

SELECT cell + c

Adding input to Cyber Chef

Use this shortcut to add cell values as input data in the CyberChef tool. Select the CyberChef icon in the toolbar to see the cells added. Learn more in Manipulate your data using CyberChef.

Equivalent writing method

To insert values as input, simply open CyberChef, click on the input field, and write the desired input.

 

Â