[b] Optional parameters use their default value unless explicitly set.
Hide omitted argument names for this functionShow omitted argument names for this function
Omitted Argument Names
The argument name for file can be omitted; the following forms of this function are equivalent:
logscale Syntax
readFile("value")
and:
logscale Syntax
readFile(file="value")
These examples show basic structure only.
When using this function, the file should exist, either because the file
has previously been uploaded (using
Uploading Files) or included as part
of an installed package.
When reading a file from a package, the package name should be specified
in addition to the filename. For example:
If you're aiming to preview the content of large files, we recommend
always including the limit
parameter to ensure optimal UI performance. However, when the file is
utilized as data input for further manipulation, the
limit parameter can be
omitted.
Preview content in a lookup file in the search portion of a repo without having to match the lookup against data
Query
logscale
readFile("host_names.csv")
Introduction
The readFile() function can be used to
preview content in a CSV
Lookup File. The
advantage of using the readFile() function
instead of the match() function, is that the
lookup will not be matched against data. In this example, the
readFile() function is used to look up a
host_names.csv file just to preview the content in it.
If you aim to preview the content of large files, we recommend
always including the
limit parameter
to ensure optimal UI performance. For example:
readFile("host_names.csv", limit=5). However, if
the file is utilized as data input for further manipulation,
the limit
parameter can be omitted.
Notice that if reading a file from a package, then the package
name should be specified in addition to the filename. For
example:
readFile("falcon/investigate/logoninfo.csv").
Event Result set.
Summary and Results
The query is used to preview content in CSV Lookup Files. After
previewing the content with the readFile()
function, it is possible to use the data for further
manipulation, for example combine it with
count() to count the rows,
select() to filter data,
join() to match data, etc. The
readFile() function can also be used to
read tables defined with the defineTable() function.
Sample output from the incoming example data:
host_id
host_name
1
DESKTOP-VSKPBK8
2
FINANCE
3
homer-xubuntu
4
logger
5
DESKTOP-1
6
DESKTOP-2
7
DESKTOP-3
Sample output from the incoming example data with
limit parameter:
host_id
host_name
1
DESKTOP-VSKPBK8
2
FINANCE
3
homer-xubuntu
4
logger
5
DESKTOP-1
Preview Content in a Lookup File With readFile() and Filter With !join()
Preview content in a lookup file in the search portion of a repo and filter for specific data with the !join() function
The readFile() function can be used to
preview content in a CSV
Lookup File. In this
example, the readFile() function is used to
look up a host_names.csv file, and then filter for host names that
do not send any logs.