Filtering in Runbook Nodes

In data query A runbook node category that gets data about the trigger and forwards it to other nodes in the runbook for further processing. nodes Individual components that make up a runbook automation, each performing a specific function such as data queries, transformations, logic, integrations, or visualizations., filtering narrows the set of entities or data that the query uses. You choose both which filter dimensions apply (e.g. application An entity type representing software applications deployed in the customer environment that are monitored for performance and anomalies., device An entity type representing network devices or hardware components deployed in the customer environment that are monitored for performance and anomalies., location An entity type representing physical or logical locations in the customer environment where entities are deployed and monitored.) and where the filter values come from.

For an overview of nodes, see Runbook Nodes, Runbook Node Categories, and Assembling runbook nodes. For the list of filter dimensions and options, see Filters and Data Query Properties.

Filter sources

Filter values can come from different places in the runbook An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook.:

• Parent or trigger: Use entities or context from the node that feeds this node (often the trigger A set of one or more indicators that have been correlated based on certain relationships, such as time, metric type, application affected, location, or network device. or the immediately preceding node).

• Input: Use values supplied at run time (e.g. from an on-demand runbook input or from a subflow input).

• Any previously executed node: In Data Ocean and Data Store nodes, you can use properties from any node that has already run in the runbook, not only the parent or input. This lets you chain queries and reuse results from earlier nodes as filter values.

Which sources are available depends on the node type. Many data query nodes support filter values from the trigger or the preceding node. In Data Ocean and Data Store nodes, you can also choose a property from any of the previously executed nodes when configuring a filter.

Data Ocean and Data Store filter sources

In Data Ocean and Data Store nodes, you can select a property from any previously executed node when configuring a filter. You can build runbooks where one query narrows the data and a later query uses that result as a filter.

Example: A runbook has three nodes:

1. A trigger that provides an application.

2. An Applications query that returns the top locations for that application.

3. A Data Ocean or Data Store node that queries device data.

When you configure the Device (or Location) filter on the third node, you can choose the location list from the Applications query (the second node) so that the third query only considers devices in those locations. The third node is not limited to the trigger or the immediately preceding node. It can use the Applications query's output because that node has already run.

You can extend this pattern: add more queries earlier in the runbook, and any later Data Ocean or Data Store node can use a property from any of them as a filter source.