The readFile() function enables users to access and utilize files previously loaded into LogScale or tables defined with defineTable() as part of query operations. The function primarily serves as a dataset for joining operations, particularly in right joins, where it can match and combine information from multiple sources using specified fields and keys.

The readFile() function reads a file that has previously been loaded into LogScale using Upload lookup files or an automated method. The function could also read tables defined with the defineTable() function.

When used, the readFile() function can operate as dataset to help seed or join with other data in the form of a primary query as part of a right join, using the defined file, or table, as the input source for the data set.

The above is a graphical representation of the following query, matching the username within :

readFile("users.csv")
| !join(query={groupBy(username)}, field=username, key=user, include=[username, id])

This basic template can be used for other similar queries when reading from lookup file. The readFile() is used with the join() function to match information. For example, the following query uses a lookup file as the basis of the query to select a base set of hostnames to use when querying access data:

readFile("host_names.csv")
| !join(query={groupBy(host_name)}, field=host_name, key=host_name, include=[host_name, id])