Querying

Overview#

The Query tab lets you write and run filters against any Live Table. Queries use the Trickest Query Language, a concise syntax built for filtering large structured datasets with exact matches, comparisons, regex patterns, and logical operators.

Writing a Query#

Open a Live Table and click the Query tab. Click New Query to create a query, then type your filter in the text editor that opens.

Operators#

Basic examples#

Exact value:

status_code = 200

Numeric comparison:

response_time > 1000

Exclude a value:

port != 80

Regex match:

hostname ~ ".*staging.*"

Multiple conditions:

port = 22 AND banner ~ "OpenSSH" AND last_seen > "2024-01-01"

Grouping Conditions with Parentheses#

Use parentheses to control how AND and OR are evaluated when combining multiple conditions:

(port = 80 OR port = 443) AND status_code = 200

(severity = "critical" AND status = "open") OR (severity = "high" AND last_seen > "2024-01-01")

Running a Query#

Click Run to execute the query against the current Live Table. Results are displayed in the table below the editor. The row count updates to reflect how many records match your filter.

To clear the filter and return to the full table, remove the query text and run again.

Selecting a dataset and columns#

Two dropdowns sit next to the Run button:

• Live Table — selects which Live Table in the current database to query. Switch between tables without leaving the Query tab.
• Columns — toggles which columns are visible in the results. Use this to focus on the fields relevant to your current filter. This does not affect the underlying data or other team members' views.

Tips#

• Start broad, then refine. Begin with a single condition and add more until you isolate exactly what you need.
• Use parentheses for mixed logic. When combining AND and OR, always use parentheses to make evaluation order explicit.

Next Steps#