PantherFlow Expressions

Use these expressions in your PantherFlow query statements

PantherFlow is in open beta starting with Panther version 1.110, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

References

Array references

Syntax
Description
Example

array[X]

Retrieve value at X

foo[1]

Object references

Syntax
Description
Example

object['X']

Retrieve value at X

foo['bar']

object.X

Retrieve value at X

foo.bar

Comparisons

Equality comparisons

Operator
Description
Example

==

Equality

A == B

!=

Inequality

A != B

Boolean comparisons

Operator
Description
Example

and

Logical and

A and B

or

Logical or

A or B

not

Logical not

not A

Numerical comparisons

Syntax
Description
Example

<

Less than

A < B

<=

Less than or equal to

A <= B

>

Greater than

A > B

>=

Greater than or equal to

A >= B

+

Add

A + B

-

Subtract

A - B

*

Multiply

A * B

/

Divide

A / B

%

Modulo

A % B

Array comparisons

Syntax
Description
Example

in

Value is in array

X in [X, Y, Z], '10.10.10.100' in p_any_ip_addresses

not in

Value is not in array

X not in [A, B, C]

Between comparisons

Operator
Description
Example

between

Value is between two values (inclusive), which are separated by ..

<foo> between <begin> .. <end>

not between

Value is not between two values (exclusive), which are separated by ..

<foo> not between <begin> .. <end>

Functions

Anonymous functions

An anonymous function, or "lambda function," is an unnamed function that can be used as an argument to the arrays.map() and arrays.filter() functions. Anonymous functions have zero or more parameters and a body that is an expression:

fn ([arg1] [, arg2...]]) { <expr> }

Example: Add one to a number in arrays.map()

In the example below, the anonymous function is applied to each of the elements in the array provided as the first argument to arrays.map():

arrays.map([1, 2, 3], fn (r) { r + 1 })

After arrays.map() applies the function on each element, the array becomes:

[2, 3, 4]

Example: Compare to null in arrays.filter()

In the example below, arrays.filter() uses the anonymous function as the filter condition:

arrays.filter([null, 5, null, 6], fn (elem) { elem != null })

After arrays.filter() filters the list using the anonymous function, it becomes:

[5, 6]

Example: Nest multiple anonymous functions

It's possible to nest anonymous functions, or use an anonymous function in the body of another anonymous function. This can be useful for extracting arrays within arrays:

let source = datatable [{
  "results": [
    {
      "cats": [
        {
          "Name": "Whiskers",
          "Breed": "Siamese",
          "FurLength": "Short",
          "ID": "AAAAA"
        },
        {
          "Name": "Mittens",
          "Breed": "Maine Coon",
          "FurLength": "Long",
          "ID": "BBBBB"
        }
      ]
    },
    {
      "cats": [
        {
          "Name": "Mr. Meow",
          "Breed": "Orange Tabby",
          "FurLength": "Short",
          "ID": "CCCCC"
        },
        {
          "Name": "Mrs. Meow",
          "Breed": "Persian",
          "FurLength": "Long",
          "ID": "DDDDD"
        }
      ]
    }
  ]
}];

source
| project results=arrays.flatten(
    arrays.map(results, fn (result) { 
        arrays.map(result.cats, fn (cat) { 
            object("CatName", cat.Name, "ID", cat.ID) 
        })
    })
)
results

[{"CatName":"Whiskers","ID":"AAAAA"},{"CatName":"Mittens","ID":"BBBBB"},{"CatName":"Mr. Meow","ID":"CCCCC"},{"CatName":"Mrs. Meow","ID":"DDDDD"}]

Last updated

Was this helpful?