In this example, the readFile() function is used to concatenate data from multiple CSV files named users_2024.csv, users_2025.csv, and temp_users.csv, combining all events into a single result set.

Example data in the CSV files might look like this:

File users_2024.csv:

File users_2025.csv:

File temp_users.csv:

The query is used to combine data from multiple CSV files into a single unified event set by concatenating their contents.

This query is useful, for example, to merge data exports from different time periods, combine CSV files from multiple departments or regions, or consolidate data from various external sources for comprehensive analysis.

Sample output from the incoming example data:

Note that the CSV files could be different formats (field names and content), but typically the schemas would match which will make it easier to query and display in a widget.

The events appear in the output in the same order as the files are specified in the function call, with all events from the first file appearing before any events from the second file, and so on.

In this example, the readFile() function is used to concatenate data from multiple lookup tables named users_2024, users_2025, and temp_users, combining all events into a single result set.

Example data in the lookup tables might look like this:

Table users_2024:

Table users_2025:

Table temp_users:

The query is used to combine data from multiple lookup tables into a single unified event set by concatenating their contents.

This query is useful, for example, to merge historical data stored in separate yearly tables, combine data from different regional databases, or consolidate temporary and permanent datasets for comprehensive analysis.

Sample output from the incoming example data:

Note that the tables could be different formats (field names and content), but typically the schemas would match which will make it easier to query and display in a widget.

The events appear in the output in the same order as the files are specified in the function call, with all events from the first table appearing before any events from the second table, and so on.

In this example, the defineTable() function is used as a right join query to extract and combine information from two different datasets.

The event set for the query is in one repository, but the event set for each query is shown separately to identify the two sets of information. The first event set is:

and the other event set:

The result will output two events:

Note that in the event set all operations have been included even when there is no match between the username field, resulting in the no value for user2. If strict=true had been used to the match() function, then the event for user2 would not have been outputted.

In this example, the readFile() function is used to look up a host_names.csv file just to preview the content in it.

Example incoming data might look like this:

|--------------------|
| host_name, host_id |
| DESKTOP-VSKPBK8, 1 |
| FINANCE, 2         |
| homer-xubuntu, 3   |
| logger, 4          |
| DESKTOP-1, 5       |
| DESKTOP-2, 6       |
| DESKTOP-3, 7       |
|--------------------|

The query is used to preview content in CSV Lookup Files. After previewing the content with the readFile() function, it is possible to use the data for further manipulation, for example combine it with count() to count the rows, select() to filter data, join() to match data, etc.

The readFile() function can also be used to read tables defined with the defineTable() function. See Perform a Right Join Query to Combine Two Datasets

Sample output from the incoming example data:

Sample output from the incoming example data with limit parameter:

In this example, the readFile() function is used to look up a host_names.csv file, and then filter for host names that do not send any logs.

Example incoming data might look like this:

|--------------------|
| host_name, host_id |
| DESKTOP-VSKPBK8, 1 |
| FINANCE, 2         |
| homer-xubuntu, 3   |
| logger, 4          |
| DESKTOP-1, 5       |
| DESKTOP-2, 6       |
| DESKTOP-3, 7       |
|--------------------|

The query is used to preview content in CSV Lookup Files, and then filter for host names that do not send any logs.

Sample output from the incoming example data: