Group by Task Instance

last updateD: june 18, 2025

The Merge task's "groupBy": "Task Instance" configuration operates similarly to grouping by "Task" with one distinction: it creates a separate merge array for each instance of the specified task.

Merge Condition Format

To apply this configuration, the merge condition must include at least the following two keys:

JSON
{
  "groupBy": "Task Instance",
  "taskName": "<Display name of a task node>"
}

Core Concepts

Example 1 - Group By Task Instance Basics

OBJECTIVE – Understand the relationship between the number of executions of the specified task in the merge condition and the quantity of merge results produced.


  1. Build the following playbook:

    lab1.d3securityonline.net_d3_main_release_p1_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=4e6e6559792ad8114acfdd4b94ec28dcac4d83a3ec3f7c606867870633ba2cdb (9) 1-20250617-202319.png
  2. Use the following merge condition:

    JSON
    {
        "groupBy": "Task Instance",
        "taskName": "A"
    }
    

    Frame 100.png
  3. Test run the playbook. Frame 1 (31)-20250602-235821.png

  4. Click on the lab1.d3securityonline.net_d3_main_release_p1_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=4e6e6559792ad8114acfdd4b94ec28dcac4d83a3ec3f7c606867870633ba2cdb (14) 2-20250617-192926.png icon within the Merge task.

    Frame 107 (1)-20250617-205028.png
  5. Note that two out of the three execution instances lack merge results.

    Frame 108 (1)-20250617-212045.png
  6. Observe the execution result in the instance rendering the Raw Data tab.
    merge result

    JSON
    [
      {
        "DataSource": { ... },
        "A": { ... },
        "D": { ... }
      }
    ]
    

    Frame 109-20250617-212126.png
  7. Repeat steps 2-6 with "B" as the merge condition taskName:

    JSON
    {
        "groupBy": "Task Instance",
        "taskName": "B"
    }
    

    merge result

    JSON
    [
      {
        "DataSource": { ... },
        "B": { ... },
        "D": { ... }
      }
    ]
    
  8. Repeat steps 2-6 with "C" as the merge condition taskName:

    JSON
    {
        "groupBy": "Task Instance",
        "taskName": "C"
    }
    

    merge result

    JSON
    [
      {
        "DataSource": { ... },
        "C": { ... },
        "D": { ... }
      }
    ]
    
  9. Repeat steps 2-6 with "D" as the merge condition taskName:

    JSON
    {
        "groupBy": "Task Instance",
        "taskName": "D"
    }
    

    merge result 1

    JSON
    [
      {
        "DataSource": { ... },
        "A": { ... },
        "D": { ... }
      }
    ]
    

    merge result 2

    JSON
    [
      {
        "DataSource": { ... },
        "B": { ... },
        "D": { ... }
      }
    ]
    

    merge result 3

    JSON
    [
      {
        "DataSource": { ... },
        "C": { ... },
        "D": { ... }
      }
    ]
    

    Frame 106-20250617-205118.png

TAKEAWAYS

  • The Raw Data tab, containing the merge results, renders only for execution instances that match the task name specified in the merge condition.

  • There is a 1:1 correspondence between the number of executions of the specified task and the number of merge results.

    • Tasks A, B, and C each execute only once. Consequently, selecting any of them in a groupBy Task Instance situation produces a single merge instance containing the merge result.

    • Task D executes three times. Consequently, selecting it in a groupBy Task Instance situation results in three merge execution instances each containing an execution lineage object.


Had step 9 been executed using the merge condition grouping by Task rather than by Task Instance, the outcome would have been a single Merge instance containing the merge result.
group by task Merge result

JSON
[
  {
    "DataSource": { ... },
    "A": { ... },
    "D": { ... },
    "Merge": { ... }
  },
  {
    "DataSource": { ... },
    "C": { ... },
    "D": { ... },
    "Merge": { ... }
  },
  {
    "DataSource": { ... },
    "B": { ... },
    "D": { ... }
  }
]
Example 2 - Merging Using a Task with Upstream and Downstream Nodes

OBJECTIVE – Understand how the Merge task processes execution lineage permutations with a designated task, considering its upstream and downstream nodes.


  1. Build the following playbook:

    lab1.d3securityonline.net_d3_main_release_p1_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=4e6e6559792ad8114acfdd4b94ec28dcac4d83a3ec3f7c606867870633ba2cdb 1-20250617-165400.png
  2. Configure the JSON Data parameter of the Unwind A node as follows:

    JSON
    [
      { "id": 1, "name": "Object 1" },
      { "id": 2, "name": "Object 2" }
    ]
    

    Frame 98-20250617-170411.png
  3. Configure the JSON Data parameter of the Unwind B node as follows:

    JSON
    [
      { "id": 3, "name": "Object 3" },
      { "id": 4, "name": "Object 4" },
      { "id": 5, "name": "Object 5" }
    ]
    

    Frame 95-20250617-170205.png
  4. Input the following merge condition:

    JSON
    {
        "groupBy": "Task Instance",
        "taskName": "ABC 1"
    }
    

    image-20250617-170507.png
  5. Click on the lab1.d3securityonline.net_d3_main_release_p1_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=4e6e6559792ad8114acfdd4b94ec28dcac4d83a3ec3f7c606867870633ba2cdb (8) 2-20250617-170925.png icon within the Merge task.

    lab1.d3securityonline.net_d3_main_release_p1_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=4e6e6559792ad8114acfdd4b94ec28dcac4d83a3ec3f7c606867870633ba2cdb (8) 1-20250617-171224.png
  6. Locate execution instances with the Raw Data tab visible, then review the execution result.

    MERGE RESULT 1

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind A": { ... },
        "ABC 1": { ... },
        "ABC 1.1": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind A": { ... },
        "ABC 1": { ... },
        "ABC 1.2": { ... }
      }
    ]
    

    MERGE RESULT 2

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind A": { ... },
        "ABC 1": { ... },
        "ABC 1.1": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind A": { ... },
        "ABC 1": { ... },
        "ABC 1.2": { ... }
      }
    ]
    

    MERGE RESULT 3

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind B": { ... },
        "ABC 1": { ... },
        "ABC 1.1": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind B": { ... },
        "ABC 1": { ... },
        "ABC 1.2": { ... }
      }
    ]
    

    MERGE RESULT 4

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind B": { ... },
        "ABC 1": { ... },
        "ABC 1.1": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind B": { ... },
        "ABC 1": { ... },
        "ABC 1.2": { ... }
      }
    ]
    

    MERGE RESULT 5

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind B": { ... },
        "ABC 1": { ... },
        "ABC 1.1": { ... },
        "Merge": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind B": { ... },
        "ABC 1": { ... },
        "ABC 1.2": { ... }
      }
    ]
    

    MERGE RESULT 6

    JSON
    [
      {
        "DataSource": { ... },
        "C": { ... },
        "ABC 1": { ... },
        "ABC 1.1": { ... },
        "Merge": { ... }
      },
      {
        "DataSource": { ... },
        "C": { ... },
        "ABC 1": { ... },
        "ABC 1.2": { ... }
      }
    
    

    Configuring the merge condition with groupBy Task instead of Task Instance will result in a single Merge execution containing one consolidated array of the same twelve objects.

TAKEAWAY

Merge results will be distributed across instances, instead of being chunked altogether in one Merge execution instance.

Example 3 - Wait for All Run Mode Vs. Merge

OBJECTIVE – Understand why the Wait for All run mode can produce a variable number of downstream executions, and how substituting a Merge task makes the execution count predictable.


  1. Build the following playbook with ta

    k with task D set to the Wait for All run mode:

  2. Frame 124.png

    Configure the JSON Data parameter of the Unwind node as follows:

    JSON
    [
      { "id": 1, "name": "Object 1" },
      { "id": 2, "name": "Object 2" },
      { "id": 3, "name": "Object 3" }
    ]
    

    Frame 125.png
  3. Run the playbook multiple times, and verify that three outcomes are possible for task D.

    lab1.d3securityonline.net_d3_staging_n8_p1_VSOC_Playbooks_D3Playbook (1) 1.png
    Task D may execute once

    lab1.d3securityonline.net_d3_staging_n8_p1_VSOC_Playbooks_D3Playbook (2) 1.png
    Task D may execute twice

    lab1.d3securityonline.net_d3_staging_n8_p1_VSOC_Playbooks_D3Playbook 1.png
    Task D may execute three times

EXPLANATION

Under the Wait for All run mode, task D executes once per complete set of inputs received from its upstream tasks (A, B, and C). The Unwind task produces three arrivals from each upstream task (A1, B1, C1, A2, B2, C2, A3, B3, and C3), and the order in which those nine arrivals reach D determines how many complete sets form.

Arrivals that do not combine into a full set are left unmatched, so D may execute one, two, or three times depending on runtime arrival order.

Example Arrival Orders at task d

  • A1, A2, A3, B1, B2, B3, C1, C2, C3: The first set completes at C1. D executes and resets. The earlier A2, A3, B2, B3 are not retained, and the remaining C2, C3 cover only one letter, so no further set forms. D executes once.

  • A1, B1, A2, C1, B2, C2, A3, B3, C3: The first set completes at C1. D executes and resets, and the extra A2 is not retained. The second set completes at A3 (after B2, C2). The trailing B3, C3 cover only two letters. D executes twice.

  • A1, B1, C1, A2, B2, C2, A3, B3, C3: Each group of three completes a set. D executes three times.

  1. Build the following playbook with all tasks set to the Wait for Any, Run Always run mode.

    Frame 123.png
  2. Input the following merge condition:

    JSON
    {
        "groupBy": "Task Instance",
        "taskName": "Insert"
    }
    

    Frame 122.png
  3. Run the playbook multiple times, and verify that task D can only execute three times.

    Frame 126.png
  4. Review the results of the Merge task within the corresponding Raw Data tabs:

    MERGE RESULT 1

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind": { ... },
        "Insert": { ... },
        "A": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind": { ... },
        "Insert": { ... },
        "B": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind": { ... },
        "Insert": { ... },
        "C": { ... }
      }
    ]
    

    MERGE RESULT 2

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind": { ... },
        "Insert": { ... },
        "A": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind": { ... },
        "Insert": { ... },
        "C": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind": { ... },
        "Insert": { ... },
        "B": { ... }
      }
    ]
    

    MERGE RESULT 3

    JSON
    [
      {
        "DataSource": { ... },
        "Unwind": { ... },
        "Insert": { ... },
        "A": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind": { ... },
        "Insert": { ... },
        "B": { ... }
      },
      {
        "DataSource": { ... },
        "Unwind": { ... },
        "Insert": { ... },
        "C": { ... }
      
    

TAKEAWAY

With the Merge task in place, every upstream arrival is captured and grouped into a merge result before being passed to task D. No arrivals are left unmatched, and task D's execution count becomes fixed (one execution per merge result).