What is the purpose of the _current and _001, _002 suffixes in Panther's rule_matches tables?
Last updated: September 3, 2024
QUESTION
In PANTHERVIEWS.PUBLIC.ALLRULEMATCHES, what is the difference between table names ending in _current vs _001, _002?
ANSWER
The_current suffix indicates the most recent version of the SQL query (i.e., the results tied to the most recent SQL).
The _001 _002 etc. suffixes represent each iteration/version of the SQL query.
For example, If there's only one version, then the results in both tables (_current and _001) should be equal.