Data Query Properties

Data query nodes in a runbook An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook. share a common set of properties. Use this page to find detailed information about each property area.

• How Filtering Works in Runbook Nodes: How filter sources work (e.g. from trigger, input, or any previously executed node).

• Filters: Reduce the set of objects (applications, devices, interfaces, and others) examined by the query. Includes dimensions and options (None, Specific, From Trigger, From Previous Node).

• Label: Name the data query node for clarity in the runbook.

• Limits: Constrain the query by the number of objects, the metric used, and the time interval.

• Metric Collection: Choose which metrics to collect and how they are formatted (summarized or time series), and over what time interval.

• Data Store: Interval: On the Data Store node, when the data type is time-aware, configure the query time range using Collect Data Based on (look-back, start and end times, or anchor plus duration). Runtime and incident variables can supply boundaries or durations.

• Data and Error outputs: Data Ocean and Data Store data query nodes expose Data and Error outputs on the canvas. See that topic for when to wire the error path and how the error payload is structured.

• Output: View the parameters that the node receives from the preceding node in the runbook. This area is read-only and shows the data passed into this query.

• Advanced: View an example of the JSON that this data query outputs. Use this to understand the structure of the data for use in downstream nodes.

Some data query nodes have additional properties. For example, the Data Store node includes Data Type, Group by, and the Interval section when the selected type supports time-based data. See each node's topic for node specific details.