Important

This function is not available in LogScale, it is only available in Falcon NG-SIEM.

Executes a federated search query on the remote data source that generates an in-memory, ad-hoc table based on its results.

For more information on using Ad-hoc tables, see Using Ad-hoc Tables.

Function Summary
SignatureremoteTable(connection, name, query)
Parameters for remoteTable()
ParameterTypeInterpreted TypeRequiredDefault ValueDescription
connectionstringrequired   The name of the federated connection used to connect to the remote data source. This needs to have already been created.
namestringrequired   The name of the table in which to store federated query results. Results are limited to 200MB per table.
querystringrequired   Query to execute on the remote data store. The query language used depends on the data source. For example, when querying an Amazon Athena data source, the Amazon Athena SQL would be used.

remoteTable() Function Operation

The remoteTable() function has specific implementation and operational considerations, outlined below:

  • You must create a federated connection before remoteTable() can perform a federated search query of a remote data source.

  • Results are limited to 200MB per table, if a larger set of data is required, refine the query and run again. Federated Search can query any amount of data allowed in the target system, but only returns the first 200MB worth of results. Note that metering is based on actual table size. Due to compression overhead, the table data can exceed the 200MB limit, even if less than 200MB was retrieved.

The purpose of remoteTable() is to enable you to perform a federated search query across supported data sources.

The basic usage form of remoteTable() is:

logscale Syntax
remoteTable(name="<name of results table>", connection="<name of federated connection>", query="<query string>")

The query string is of the form appropriate for the data source. For example, for a query of an Athena data source the syntax used would be Amazon Athena SQL.

See Federated Search documentation for more information.

remoteTable() Syntax Examples

This section provides some examples of using remoteTable() with an Athena data source. For more examples for other data sources see the documentation.

To return a list of available tables:

logscale Syntax
remoteTable(name="myTable", connection="myAthenaConnection", query="show tables")
| readFile("myTable")

In this case there is just one table returned, test:

test

To obtain column definitions:

logscale Syntax
remoteTable(name="myTable", connection="myAthenaConnection", query="describe test")
| readFile("myTable")

This would return results similar to the following example:

col_namecommentdatatype
transaction_id<empty string>string
customer_id<empty string>string
product_id<empty string>string

If you want to determine the structure of a table you can perform a query similar to:

logscale Syntax
remoteTable(name="myTable", connection="myAthenaConnection", query="select * from test limit 4")
| readFile("myTable")

Would return results such as:

categorycustomer_idprice
SportswearC368899
AccessoriesC493699
ElectronicsC1922999
ApparelC302899

Note that limit is used to reduce the number of returned results, simplifying the output. This is useful to manage performance and potentially reduce the cost of the query.