Linked Queries
Linked queries can be connected or linked to one or more existing queries which allows it to use its device lists, as long as the existing queries return non-empty results. The linked query will only act on those devices that meet the existing query criteria.
A linked query can be considered as a results-based device selector. The overview concept is similar to multilevel Boolean searches, where the previous search is used for more detailed results. It can also be viewed as a type of filter.
Linked queries pass the list of devices that meet the first query's criteria to the second query for further filtering. Linked queries do not perform any actions on the actual data returned from the first query's criteria match.
A linked query can contain its own search criteria.
Using Linked Queries
Linked queries can be used with Orbital Catalog queries or existing user built queries. To use linked queries, you need to select one or more existing queries.
You can access the linked queries feature from the Investigate and Results pages.
To access linked queries from the Investigate page:
-
Open Investigate page.
-
Click Link queries under the Devices field.
The Link queries drop-down will display the last 50 existing queries. If you want to select one or more queries that are older than the 50 listed in this drop-down, use the Results page.
-
Navigate to an existing query and select it by clicking the check box.
You can select more than one existing query by clicking multiple check boxes.
-
Click Add. This will populate the Devices field with all of the devices used by the query that you linked to.
-
Once you have identified the query you want to run your query against, you can either write your own queries in the Custom SQL field or select a built-in query from the Catalog query.
To access linked queries from the Results page:
-
Open the Results page.
-
Scroll to the desired existing query.
-
Click the three-dot menu icon (
). -
Select Link query from the action menu. This will populate the Devices field with the name of the chosen existing query.
-
Once you have identified the existing query or queries you want to run your query against, you can either write your own queries in the Custom SQL field or select a built-in query from the Catalog.