Datatable Operator

Provide sample data with PantherFlow's datatable operator

Overview

Provide sample data as a table source (instead of referencing a live Snowflake table) with datatable.

datatable [{...}, {...}, ...]

The datatable operator will likely be most useful during testing, but it can also be used in other situations, for example, when performing a join to create a simple Lookup Table. See an example of how to use the join operator with datatable on Join Operator.

Because JSON is valid PantherFlow, it's possible to copy and paste a JSON object into a datatable statement.

A datatable is one of the possible PantherFlow data sources and as such, can be used in any place a table is allowed.

Example

datatable [
    {"name": "paul.paulson", "favorite_food": "pineapple"},
    {"name": "samantha.samson", "favorite_food": "carrot"}
]
| where favorite_food == 'pineapple'

Result:

favorite_food	name
pineapple	paul.paulson