partition

Partition a table into sections, where the filter for the partition is generated automatically.

For example, assume that your table has two distinct values and that you want to split it into two tables where each table contains only one of the distinct values.

Using basic LQL you can write

partition1 = select * from table where col = "value1"
partition2 = select * from table where col = "value2"

If partition1 contains multiple filter conditions, becomes more complex:

partition1 = select * from table where col = "value1" or col = "value3" or col = "value4"

The basic LQL method has these limitations:

• If value1, value2 ... are large strings, specifying the string accurately can become difficult.

• If the table has multiple distinct values, it can be hard to remember the values for which you have already created partitions.

The partition operator addresses these issues and improves the user interaction.

To create partitions from a table, use group by or distinct keywords in the LQL. This adds additional widgets as in the following image.

Each row has a checkbox for you to create a partition using those keywords/values. You can select multiple rows to create a single partition. After selecting the rows, the bottom of the table displays a +Partition control. When clicked, a new child step is created with the following LQL:

_partition(basetable, referenceTable, "(column= "keyword"/value )_

When the step is created each row has a link widget, which you can click to view the partition table for that filter.

+Default Partition creates a single partition for the values that are not used in any partitioning conditions.

Operator Usage in Easy Mode

1. Click + on the parent node.

2. Enter the Partition operator in the search field and select the operator from the Results to open the operator form.

3. In the Reference Table drop-down, enter or select the name of the table with a group used to generate the selected conditions.

4. In the Base Table drop-down, enter or select the base table to select the data from.

5. Optional. In the Condition field, click Add More to add the condition to select events from baseTable.

6. Click Run to view the result.

7. Click Save to add the operator to the playbook.

8. Click Cancel to discard the operator form.

Usage Details

It is not recommended to use the partition operation on its own. Refer to this section if you want to try doing so.

Select data from the baseTable using the condition or, if no condition is specified, the rest of the data not already selected by another PartitionOperator.

LQL Command

Input:
referenceTable: SQL table with a group by used to generate the selection conditions.
baseTable: Table to select data from from.
conditions: Lst of conditions to select events from baseTable.

Output:
A subset of the baseTable that matches the condition.