3.3 Merging Questions to Add Columns
Key Takeaways
- Merging issues a second question in the background and re-displays the Question Results grid with one or more additional columns for the merged sensors.
- Merge operations automatically apply to all results, so unlike drill-down there is no need to select grid rows before merging.
- Only non-counting questions can be used in merge operations, so a counting question must first be made non-counting by adding a per-endpoint sensor such as Computer Name.
- In a merge question you add sensors to the get clause but not filters to the from clause, because the from clause is set automatically from the rows in the results grid.
- A saved question appears on the Merge dialog only when it is in a content set you can read and has the setting that displays it in the list of questions available to merge.
3.3 Merging Questions to Add Columns
Quick overview: Merge answers a different need from drill-down. Question results often lead to additional questions — you have a list of endpoints and running processes, and now you want the last logged-in user next to each one. Merging issues a second question in the background and re-displays the Question Results grid with one or more additional columns. It applies to all results automatically, and it accepts only non-counting questions.
1. What merging is for
Tanium's own framing: the results of a question that returns computer names and running processes might indicate that some endpoints are running a suspicious process; you can merge the initial question with another question to learn more information, such as the last logged-in user.
The pattern is enrichment. You are not narrowing the population — you are widening what you know about it.
BEFORE MERGE AFTER MERGE
------------ -----------
Computer Name | Running Process Computer Name | Running Process | Last Logged In User
WKS-0101 | odd.exe WKS-0101 | odd.exe | corp\jsmith
WKS-0233 | odd.exe WKS-0233 | odd.exe | corp\aroy
SRV-0410 | odd.exe SRV-0410 | odd.exe | corp\svc_backup
That third column is what turns a technical finding into an actionable one — three endpoints, but one of them is a service account on a server, which is a different conversation from two workstations.
2. The rules that govern merging
Merges apply to everything
Merge operations automatically apply to all results. You do not need to select grid rows before merging. This is the single most common point of confusion between merge and drill-down, and it is a favourite exam discriminator.
Only non-counting questions
You can use only non-counting questions in merge operations.
A counting question groups identical results and shows a Count; a non-counting question returns one row per endpoint. Merging a per-endpoint attribute into an aggregated row is meaningless — there is no single "last logged-in user" for the 32,000 endpoints collapsed into one Windows 11 row — so the platform simply does not allow it.
[!TIP] The fix when Merge refuses your question: add a sensor that is unique per endpoint —
Computer Nameis the usual choice — to thegetclause. That makes every row distinct, converts the question to non-counting, and merging becomes available.
3. The workflow
- On the Question Results page, click Merge in the grid toolbar.
- Add questions using one of the tabs, then click Merge:
- Saved Questions — lists saved questions assigned to content sets for which you have Saved Question read permission, and which have the Display this question in the list of questions that are available to merge setting enabled.
- Create / build a question — compose the merge question directly.
- The Question Results grid re-displays with the additional columns.
- Use the Edit button in the grid header to modify the merge settings afterwards.
The from clause is handled for you
When you build a merge question, you add sensors to the get clause but you do not add filters to the from clause. The from clause is determined automatically by the rows in the Question Results grid. Trying to re-specify targeting in a merge question is a category error — the population is already fixed by the question you are merging into.
4. Merge versus drill down, side by side
| Merge | Drill down | |
|---|---|---|
| Intent | Add attributes to the population you already have | Narrow to the endpoints behind selected rows |
| Row selection | Not needed — applies to all results | Required |
| Output | Same grid, extra columns | New grid, fewer endpoints |
from clause | Set automatically by the grid contents | Filters the selected results |
| Question type | Non-counting only | Works from counting or non-counting results |
| Saved question flag | Available to merge | Available for drilling down (with a Show all questions override) |
| Typical trigger | "I need one more column" | "Which machines were those?" |
5. Worked example: from a distribution to a decision
Requirement: identify which endpoints are running an out-of-date browser build, and who is using them, so the service desk can contact the right people.
| Step | What you do | Why this step |
|---|---|---|
| 1 | Get Installed Applications having Installed Applications:Name contains Chrome from all machines with Operating System contains Windows | Column filter keeps the grid to Chrome rows; with keeps it to Windows endpoints |
| 2 | Notice the grid is counting — versions are aggregated | Useful for seeing the version spread, useless for contacting users |
| 3 | Add Computer Name to the get clause and re-ask | Converts to a non-counting question, one row per endpoint, now merge-eligible |
| 4 | Click Merge, add Last Logged In User | Enrichment applies to all rows automatically |
| 5 | Click Merge again, add Open Ports or another context sensor if needed | Merges stack; the grid keeps widening |
| 6 | Select up to 100 rows and Deploy Action, or export the grid | Chapter 4 covers deployment; chapter 6 covers export |
Notice what happened at step 3: the decision to make the question non-counting was driven by what you needed to do next, not by the question itself. That is the practical judgement the Refining Questions domain is testing.
6. Common mistakes
| Mistake | What actually happens |
|---|---|
| Selecting rows first, expecting merge to respect the selection | Merge applies to all results regardless of what you selected |
| Trying to merge a counting question | The question is not eligible; add a per-endpoint sensor |
Adding a from filter to the merge question | The from clause is set automatically from the grid; your filter has no place to go |
| Assuming a colleague's saved question will appear | It appears only if it is in a content set you can read and has the available to merge flag |
| Merging when you meant to narrow | You end up with a wider grid and the same endpoint count; drill down instead |
An operator selects three rows in the Question Results grid and then clicks Merge, expecting the extra column to appear only for those three rows. What actually happens?
Why can a counting question not be used in a merge operation?
When building a merge question, what should the operator do about the from clause?
An operator has a counting question showing the distribution of Chrome versions and needs to contact the users of the out-of-date endpoints. What sequence achieves this?