📢 Read the latest Release Notes to learn what's new on Hunters! 💡

Work with notebooks

Prev Next

A notebook is an ordered list of SQL and text cells on the Search page (Notebook mode). A SQL cell can read an earlier cell's results as a table. A notebook cannot produce widgets or dashboards; build those in SQL mode.

Cell references

To use an earlier cell's results as a table, write {{Cell name}}. Typing @, FROM, JOIN or INTO offers a list of earlier cells.

Cell 2 reading Cell 1

Three rules apply:

  1. The referenced cell must come earlier in the notebook.
  2. The referenced cell must have been run. References read its stored result, not its SQL. Until it has run, Run Query stays disabled.
  3. References are by name. Renaming a cell silently breaks every reference to it. Nothing marks the broken SQL; the only sign is that Save becomes disabled. Rename cells before you reference them.

Results are not saved with the notebook. After you open or save a notebook, run the cells again, or select Run All, before references work. A referenced result is available for about 24 hours.

Run All runs the SQL cells from top to bottom and stops at the first failure.

Switching data type deletes every cell

A notebook runs against one data type. Changing it, even between RAW Data and OCSF Data, replaces the whole notebook with one empty SQL cell, text cells included.

Switch data type confirmation

Don't save after an accidental switch

On a saved notebook, the switch leaves Save changes enabled, and one click overwrites the saved notebook with the empty cell. Reload the page and reopen the notebook from the Query Library instead.

Saving and sharing

  • Save changes overwrites the notebook. There is no version history.
  • Close detaches the notebook but keeps the cells on screen. Saving after that creates a new notebook.
  • Sharing is all-or-nothing for your organization. Others can open and run a shared notebook, and Save as Copy to keep their own version, but they see no results until they run it.
  • Notebook rows in the Query Library don't show the data type.