dropColumns

Remove columns from a table.

For example, if you have columns a,b,c,d,e,f,g,h,i,j,k) and want to remove columns j,k, you can easily use the following LQL query where j and k are excluded from the query.

LQL

select a, b, c, d, e, f, g, h, i from table

However, the process becomes more tedious and prone to error if the columns have long names, such as a = s3bucketAccountID, b = messageResponseTime, and so on. This operator addresses this issue.

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter the Drop Columns operator in the search field and select the operator from the Results to open the operator form.
3. In the Table drop-down, enter or select a table that you want to drop the columns.
4. In the Column drop-down, select a column or multiple columns to remove from the table.
5. Click Run to view the result.
6. Click Cancel to discard the operator form.
7. Click Submit to add the operator to the playbook.

Usage Details

LQL Command

dropColumns(table, "col1", "col2" ...)

Example

Input

LQL command

dropColumns(table, "sourceIP") -- drop sourceIP column
dropColumns(table, "sourceIP", "sourcePort") -- drop sourceIP and sourcePort columns