Data Query Filters

Data query A runbook node category that gets data about the trigger and forwards it to other nodes in the runbook for further processing. nodes Individual components that make up a runbook automation, each performing a specific function such as data queries, transformations, logic, integrations, or visualizations. in a runbook An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook. pull data about applications An entity type representing software applications deployed in the customer environment that are monitored for performance and anomalies., devices An entity type representing network devices or hardware components deployed in the customer environment that are monitored for performance and anomalies., interfaces An entity type representing network interfaces on devices that are monitored for performance metrics and anomalies., locations An entity type representing physical or logical locations in the customer environment where entities are deployed and monitored., hosts, and other entities Things deployed in the customer environment that are needed to run the business, such as applications, devices, interfaces, and locations.. Without filters, a query can consider all such entities in scope, which can be slow or too broad for the incident A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself. you are investigating. Filters narrow the set so the runbook focuses on the right applications, devices, interfaces, or locations. This topic describes the filter dimensions and options you see in the Runbook Editor on data query nodes. For how filter values are supplied (from the trigger A set of one or more indicators that have been correlated based on certain relationships, such as time, metric type, application affected, location, or network device., from the previous node, or from elsewhere in the runbook), see How Filtering Works in Runbook Nodes.

Where you configure filters

In the Runbook Editor, select a data query node and open its properties. The Filters section lists the dimensions that apply to that node type (for example Application, Device, Interface). Which dimensions appear depends on the node: an Applications query shows Application and possibly Location, a Devices query shows Device and possibly Interface, and so on. You can add more filters with Add A Filter or Add More Filters when extra dimensions are available. For the full set of data query node types and their filters, see Data Query Properties and the topics for each node (for example Devices, or Data Store).

Filter options

For each filter dimension you choose where the filter value comes from. The same pattern applies across dimensions, though not every dimension offers every option:

None (optional): The query does not apply a filter for that dimension; the query considers all entities of that type in scope.
Specific: You type a comma-separated list of names or identifiers. The query includes only those entities. The UI User Interface. The visual components and controls that users interact with to access features and manage the system. (user interface) label varies (e.g. Specific Apps, Specific Devices, Specific Interfaces, Specific Locations, Specific Hosts, Specific Client Hosts, Specific Server Hosts).
From trigger: Use the entities provided by the runbook trigger (for incident runbooks, the incident’s application, device, interface, or location). In subflow or on-demand runbooks the same idea appears as From subflow input or From on-demand input.
From previous node: Use the entities that the preceding node outputs (the node that feeds this one in the runbook). In Data Ocean and Data Store nodes you can also choose a property from any previously executed node, not only the immediate predecessor. That lets you chain queries and reuse results as filter values.

Choosing a value from the trigger or a previous node keeps the runbook tied to the incident or to the output of an earlier step, so you do not have to hard-code names.

Filter dimensions

The following dimensions appear on data query nodes. Which of them appear on a given node depends on the node type.

Application: Narrow by application. Options include None, Specific Apps, Apps from trigger (or input), and Apps from previous node.
Client: Narrow by client host. Options include None, Specific Client Hosts, and Client Hosts from previous node.
Device: Narrow by device. Options include None, Specific Devices, Device from trigger (or input), and Device from previous node.
Host: Narrow by host. Options include None, Specific Hosts, and Hosts from previous node.
Interface: Narrow by interface. Options include None, Specific Interfaces, Interface from trigger (or input), and Interface from previous node.
Location: Narrow by location. Options include None, Specific Locations, Locations from trigger (or input), and Locations from previous node.
Server: Narrow by server host. Options include None, Specific Server Hosts, and Server Hosts from previous node.

Other dimensions (for example Client Location, Server Location, Protocol, User Device, or Data Source) may appear on specific node types. Use the Runbook Editor to see the exact list for each node.