Feedback:

yieldtable

Use the yieldtable operator to generate a lookup table having the name you specify and the columns and rows from the results generated when the search is run.

Syntax

|yieldtable <table name> [is_temp={false|true}] [append={false|true}]

|outputcsv <table name> [is_temp={false|true}] [append={false|true}]

<table name>

Specify a table name. If you specify the name of an existing table, that table is overwritten with the results from your query.
is_temp={false|true}

Optional.

Specify true to allow the lookup table to be deleted from temporary storage after the TTL expires. Specifying true makes it a “temp table”.

Specify false to set no TTL for the table. In effect, this setting creates a more permanent lookup table.

See Managing Lookup Tables for information about lookup tables.

append={false|true}

Optional.

Specifying true will append the results to the existing lookup table.

Specifying false will overwrite the old table and create a new lookup table with the generated results.

Usage

The yieldtable operator should be the last piped operator in a query. It is used to publish the results of the query formed by the piped expressions preceding it into a temporary results table. Anomali recommends you refine the results table using where filters and fields lists to produce refined lookup tables that meet your requirements.

yieldtable supports OCSF nested object fields when creating lookup tables. The lookup table schema preserves the top-level object fields, for example, src_endpoint, along with the full nested field structure.

Note: Lookup tables created using the yieldtable operator cannot be updated.

The outputcsv operator is an alias of the yieldtable operator. In other words, the usage for outputcsv is exactly the same as the usage for yieldtable.

Examples

Example 1: Save top ten users to a new lookup table.

Copy 
|top 10 user |yieldtable top_10_user_tabl

Example 2: Counts OCSF events per user per hour, then writes the result to a temporary table ocsf_qa_temp_table_append_false, overwriting any existing data.

Copy 
ocsf | timetrend count as event_count by actor.user.name span=1h | yieldtable ocsf_qa_temp_table_append_false is_temp=true format=parquet append=false

Example 3: Create a lookup table from OCSF events using OBJECT sub-fields, then query the resulting table.

Copy 
ocsf 
                | where src_endpoint.ip != '' 
                | fields event_time, src_endpoint, dst_endpoint 
            | yieldtable ocsf_endpoint_lookup_example is_temp=true format=parquet append=true

Then, to query from the resulting lookup table:

Copy 
ocsf_endpoint_lookup_example | iplocation src_endpoint.ip | fields src_endpoint.ip, country, lat, lon