Combine tables.

Combine (create the union) of the tables listed in the arguments.

For example: instead of writing following LQL command to combine multiple tables:

select * from cloudtrail union
select * from github union
select * from windows union
select * from vpc

you can use the unionAll operator.

unionAll(cloudtrail, github, windows, vpc)

Note: unionAll operator will union tables even if they have different schemas, columns, types:

  • different columns: it will add empty columns to the table that doesnt contain that column
  • different types: it will convert different types with same column name to string
    that it will perform join

Operator Usage in Easy Mode

  1. Click + on the parent node.
  2. Enter the Union All operator in the search field and select the operator from the Results to open the operator form.
  3. In the Base Table drop-down, enter or select a node.
  4. Optional. Click Show Optional Field to union with another input table. In the Union With drop-down, enter or select single or multiple nodes.
  5. Click Run to view the result.
  6. Click Cancel to discard the operator form.
  7. Click Submit to add the operator to the playbook.

Usage Details


tables: List of tables to combine

Union of all tables



source_ip source_port


source_ip source_port
unionAll(table1, table2)


source_id source_port

© Devo Technology Inc. All Rights Reserved.