# Datatable Operator

## Overview

Provide sample data as a table source (instead of referencing a live Snowflake table) with `datatable`.

```kusto
datatable [{...}, {...}, ...]
```

The `datatable` operator will likely be most useful during testing, but it can also be used in other situations, for example, when performing a `join` to create a simple Lookup Table. See an example of how to use the `join` operator with `datatable` on [Join Operator](https://docs.panther.com/pantherflow/operators/join).

Because JSON is valid PantherFlow, it's possible to copy and paste a JSON object into a `datatable` statement.

A `datatable` is one of the [possible PantherFlow data sources](https://docs.panther.com/statements#data-sources) and as such, can be used in any place a table is allowed.

## Example

```kusto
datatable [
    {"name": "paul.paulson", "favorite_food": "pineapple"},
    {"name": "samantha.samson", "favorite_food": "carrot"}
]
| where favorite_food == 'pineapple'
```

Result:

| favorite\_food | name         |
| -------------- | ------------ |
| pineapple      | paul.paulson |