You can create new columns in your data tables based on other data already in the table. For example, apply a geolocation operation on an existing IP address column to create a new column that identifies the country. Devo comes full of predefined standard operations to help you create new columns but you can also create custom operations, based on lookup tables, suited to your organization's particular information. See Lookup management, for information about creating custom lookup tables in Devo.
To create a new column in a data table, select Create Column from the query toolbar. The Operations Over Columns window appears with the Create column option selected.
- Select the operation to perform from the Operation dropdown list. Choose standard for the list of Devo-defined operations, or custom for operations created by your organization. Click the info icon to see a tooltip description of the operation. See Available operations for more information on the operations you can use when creating a new column.
- Select New Argument to choose the column over which the selected operation should be performed.
- The Column Name field completes automatically based upon your selection of operations and arguments. However, you can edit this if you choose. We recommend that you do not use spaces or special characters in column names in order to avoid possible issues when creating aggregations based on the new column.
Example: Creating a new column with geolocation coordinates
Among the standard Devo operations, there are several that provide geolocation data based on an IP address. In this example, we create two new columns, with latitude and longitude coordinates based upon IP address information.
- Go to Data search and run the following search: firewall.paloalto.traffic.
- Select Create column from the toolbar.
- Enter Latitude as the Column Name.
- Select standard as the operation type, then GeoLocated Latitude as the Operation.
- Select New Argument and choose srcIP from the list.
- Click Create Column.
- Repeat these steps using GeoLocated Longitude as the Operation to create the new column for Longitude. The result is two new columns for Latitude and Longitude.
See Create column operations for more information on the operations you can use when creating a new column.