Skip to main content

Overview

The Query tab lets you write and run filters against any Live Table. Queries use the Trickest Query Language, a concise syntax built for filtering large structured datasets with exact matches, comparisons, regex patterns, and logical operators.

Writing a Query

Open a Live Table and click the Query tab. Click New Query to create a query, then type your filter in the text editor that opens.

Operators

OperatorDescriptionApplicable types
=Exact matchStrings, numbers, dates, IPs
!=Does not matchStrings, numbers, dates, IPs
>Greater thanNumbers, dates
<Less thanNumbers, dates
~Matches regex patternStrings
!~Does not match regex patternStrings
ANDBoth conditions must be true
OREither condition can be true

Basic examples

Exact value:
status_code = 200
Numeric comparison:
response_time > 1000
Exclude a value:
port != 80
Regex match:
hostname ~ ".*staging.*"
Multiple conditions:
port = 22 AND banner ~ "OpenSSH" AND last_seen > "2024-01-01"
Quote strings and dates. Leave numbers unquoted. When using regex, escape special characters with a backslash (e.g., use \\. to match a literal period).

Grouping Conditions with Parentheses

Use parentheses to control how AND and OR are evaluated when combining multiple conditions:
(port = 80 OR port = 443) AND status_code = 200
(severity = "critical" AND status = "open") OR (severity = "high" AND last_seen > "2024-01-01")
Nested parentheses are not supported. Each group must be a flat list of conditions joined by a single logical operator.Valid:
(cond1 AND cond2) OR (cond3 AND cond4)
Invalid:
((cond1 AND cond2) OR cond3) AND cond4

Running a Query

Click Run to execute the query against the current Live Table. Results are displayed in the table below the editor. The row count updates to reflect how many records match your filter. To clear the filter and return to the full table, remove the query text and run again.

Selecting a dataset and columns

Two dropdowns sit next to the Run button:
  • Live Table — selects which Live Table in the current database to query. Switch between tables without leaving the Query tab.
  • Columns — toggles which columns are visible in the results. Use this to focus on the fields relevant to your current filter. This does not affect the underlying data or other team members’ views.

Tips

  • Start broad, then refine. Begin with a single condition and add more until you isolate exactly what you need.
  • Use parentheses for mixed logic. When combining AND and OR, always use parentheses to make evaluation order explicit.

Next Steps