Group by Task Instance

last updateD: june 18, 2025

The Merge task's "groupBy": "Task Instance" configuration operates similarly to grouping by "Task" with one distinction: it creates a separate merge array for each instance of the specified task.

Merge Condition Format

To apply this configuration, the merge condition must include at least the following two keys:

JSON
{
  "groupBy": "Task Instance",
  "taskName": "<Display name of a task node>"
}

Core Concepts

Example 1 - Group By Task Instance Basics

OBJECTIVE – Understand the relationship between the number of executions of the specified task in the merge condition and the quantity of merge results produced.


  1. Build the following playbook:

    lab1.d3securityonline.net_d3_main_release_p1_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=4e6e6559792ad8114acfdd4b94ec28dcac4d83a3ec3f7c606867870633ba2cdb (9) 1-20250617-202319.png
  2. Use the following merge condition:

    JSON
    {
        "groupBy": "Task Instance",
        "taskName": "A"
    }
    
    Frame 100.png
  3. Test run the playbook. Frame 1 (31)-20250602-235821.png

  4. Click on the lab1.d3securityonline.net_d3_main_release_p1_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=4e6e6559792ad8114acfdd4b94ec28dcac4d83a3ec3f7c606867870633ba2cdb (14) 2-20250617-192926.png icon within the Merge task.

    Frame 107 (1)-20250617-205028.png
  5. Note that two out of the three execution instances lack merge results.

    Frame 108 (1)-20250617-212045.png
  6. Observe the execution result in the instance rendering the Raw Data tab.
    merge result

    JSON
    [
      {
        "DataSource": { ... },
        "A": { ... },
        "D": { ... }
      }
    ]
    
    Frame 109-20250617-212126.png
  7. Repeat steps 2-6 with "B" as the merge condition taskName:

    JSON
    {
        "groupBy": "Task Instance",
        "taskName": "B"
    }
    

    merge result

    JSON
    [
      {
        "DataSource": { ... },
        "B": { ... },
        "D": { ... }
      }
    ]
    
  8. Repeat steps 2-6 with "C" as the merge condition taskName:

    JSON
    {
        "groupBy": "Task Instance",
        "taskName": "C"
    }
    

    merge result

    JSON
    [
      {
        "DataSource": { ... },
        "C": { ... },
        "D": { ... }
      }
    ]
    
  9. Repeat steps 2-6 with "D" as the merge condition taskName:

    JSON
    {
        "groupBy": "Task Instance",
        "taskName": "D"
    }
    

    merge result 1

    JSON
    [
      {
        "DataSource": { ... },
        "A": { ... },
        "D": { ... }
      }
    ]
    

    merge result 2

    JSON
    [
      {
        "DataSource": { ... },
        "B": { ... },
        "D": { ... }
      }
    ]
    

    merge result 3

    JSON
    [
      {
        "DataSource": { ... },
        "C": { ... },
        "D": { ... }
      }
    ]
    
    Frame 106-20250617-205118.png

TAKEAWAYS

  • The Raw Data tab, containing the merge results, renders only for execution instances that match the task name specified in the merge condition.

  • There is a 1:1 correspondence between the number of executions of the specified task and the number of merge results.

    • Tasks A, B, and C each execute only once. Consequently, selecting any of them in a groupBy Task Instance situation produces a single merge instance containing the merge result.

    • Task D executes three times. Consequently, selecting it in a groupBy Task Instance situation results in three merge execution instances each containing an execution lineage object.


Had step 9 been executed using the merge condition grouping by Task rather than by Task Instance, the outcome would have been a single Merge instance containing the merge result.
group by task Merge result

JSON
[
  {
    "DataSource": { ... },
    "A": { ... },
    "D": { ... },
    "Merge": { ... }
  },
  {
    "DataSource": { ... },
    "C": { ... },
    "D": { ... },
    "Merge": { ... }
  },
  {
    "DataSource": { ... },
    "B": { ... },
    "D": { ... }
  }
]
Example 2 - Merging Using a Task with Upstream and Downstream Nodes

OBJECTIVE – Understand how the Merge task processes execution lineage permutations with a designated task, considering its upstream and downstream nodes.


  1. Build the following playbook:

    lab1.d3securityonline.net_d3_main_release_p1_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=4e6e6559792ad8114acfdd4b94ec28dcac4d83a3ec3f7c606867870633ba2cdb 1-20250617-165400.png
  2. Configure the JSON Data parameter of the Unwind A node as follows:

    JSON
    [
      { "id": 1, "name": "Object 1" },
      { "id": 2, "name": "Object 2" }
    ]
    
    Frame 98-20250617-170411.png
  3. Configure the JSON Data parameter of the Unwind B node as follows:

    JSON
    [
      { "id": 3, "name": "Object 3" },
      { "id": 4, "name": "Object 4" },
      { "id": 5, "name": "Object 5" }
    ]
    
    Frame 95-20250617-170205.png
  4. Input the following merge condition:

    JSON
    {
        "groupBy": "Task Instance",
        "taskName": "ABC 1"
    }
    
    image-20250617-170507.png
  5. Click on the lab1.d3securityonline.net_d3_main_release_p1_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=4e6e6559792ad8114acfdd4b94ec28dcac4d83a3ec3f7c606867870633ba2cdb (8) 2-20250617-170925.png icon within the Merge task.

    lab1.d3securityonline.net_d3_main_release_p1_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=4e6e6559792ad8114acfdd4b94ec28dcac4d83a3ec3f7c606867870633ba2cdb (8) 1-20250617-171224.png
  6. Locate execution instances with the Raw Data tab visible, then review the execution result.

    MERGE RESULT 1

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind A": { ... },
        "ABC 1": { ... },
        "ABC 1.1": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind A": { ... },
        "ABC 1": { ... },
        "ABC 1.2": { ... }
      }
    ]
    

    MERGE RESULT 2

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind A": { ... },
        "ABC 1": { ... },
        "ABC 1.1": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind A": { ... },
        "ABC 1": { ... },
        "ABC 1.2": { ... }
      }
    ]
    

    MERGE RESULT 3

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind B": { ... },
        "ABC 1": { ... },
        "ABC 1.1": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind B": { ... },
        "ABC 1": { ... },
        "ABC 1.2": { ... }
      }
    ]
    

    MERGE RESULT 4

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind B": { ... },
        "ABC 1": { ... },
        "ABC 1.1": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind B": { ... },
        "ABC 1": { ... },
        "ABC 1.2": { ... }
      }
    ]
    

    MERGE RESULT 5

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind B": { ... },
        "ABC 1": { ... },
        "ABC 1.1": { ... },
        "Merge": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind B": { ... },
        "ABC 1": { ... },
        "ABC 1.2": { ... }
      }
    ]
    

    MERGE RESULT 6

    JSON
    [
      {
        "DataSource": { ... },
        "C": { ... },
        "ABC 1": { ... },
        "ABC 1.1": { ... },
        "Merge": { ... }
      },
      {
        "DataSource": { ... },
        "C": { ... },
        "ABC 1": { ... },
        "ABC 1.2": { ... }
      }
    ]
    

    Configuring the merge condition with groupBy Task instead of Task Instance will result in a single Merge execution containing one consolidated array of the same twelve objects.

TAKEAWAY

Merge results will be distributed across instances, instead of being chunked altogether in one Merge execution instance.