Looker Business Analyst cheat sheet

Looker queries a database in real time at query time; it stores no extracted data by default, so results reflect current warehouse contents.

LookML is the modeling language Looker uses to describe dimensions, measures, joins, and Explores; it is version-controlled text, not a GUI-only configuration.

A Project is a collection of LookML files; a Model file defines Explores, and a View file defines fields and joins.

Persistent Derived Tables (PDTs) are written back to a scratch schema; they refresh on a trigger (datagroup or SQL trigger) rather than every query.

Symmetry: Looker computes measures over the full joined set, then aggregates to the level of the selected dimensions, preventing fan-out double counting.

Primary key is declared on a dimension with primary_key: yes; it enables symmetric aggregates and join relationship enforcement.

Explore = a predefined starting point for users; it bundles a base view plus joined views and exposes only fields the modeler allows.

Looker content hierarchy: Looks (saved queries) and Dashboards are built from Explores; Boards organize content for a team or individual.

Development Mode is per-user and isolated; changes stay in the user's workspace until deployed to production via the shared branch.

Dimension types: string, number, yesno, date, time, timestamp, and tier; each controls formatting, filters, and drill behavior.

Measure types: count, count_distinct, sum, average, min, max, list, and derived; type: sum requires a sql expression referencing a numeric column.

Join relationship values are one_to_one, many_to_one, one_to_many, and many_to_many; many_to_one is the most common and safest for fact-to-dimension joins.

sql_on defines a custom join condition; foreign_key is shorthand that joins on the primary key of the joined view.

Datagroups control PDT rebuild scheduling; a datagroup with sql_trigger runs a query and rebuilds only when the returned value changes.

Derived tables are declared with view: name { derived_table: { sql: ... } }; persist_for or datagroup controls caching and rebuild.

Refinements (refine: view_name) extend an existing view without editing it, useful for adding fields or filters to a shared view.

Access filters (access_filter) enforce row-level security by injecting a user attribute into every query on the Explore.

extends allows one view or Explore to inherit fields from another; the extending object overrides conflicting definitions.

Filter syntax supports matches advanced: value, null, -null, and date keywords like 7 days, this month, and before 2024.

Pivots turn a dimension into columns; measures then render per pivot value, which changes the grain of the result set.

Custom fields (table calculations, custom dimensions, custom measures) are user-level and not saved to LookML unless promoted.

Table calculation functions include running_total, offset, row(), pivot_index, and percent_of_total; they evaluate after the query returns.

Visualization types: table, column, bar, line, area, scatter, pie, single value, and map; choose line for time series and bar for categorical comparison.

Drill fields (drill_fields) define which fields appear when a user clicks a data point to drill into detail.

Sorting and row limits apply per query; a row limit on the Explore caps rows returned, and totals can be added for table visualizations.

Merged results combine queries from different Explores on a shared dimension; the join key must match in name and type.

Scheduled deliveries run Looks or Dashboards on a cadence and send results via email, webhook, or to a destination like SFTP or S3.

Alerts trigger when a numeric condition is met (for example, value > threshold) and notify via email or webhook; they require a single-value or supported visualization.

Content access levels: private (owner only), folder-level, and public; folders inherit permissions from parent folders unless overridden.

Roles: Admin, Developer, and Viewer; Developers can edit LookML in Development Mode but cannot manage users unless also Admin.

User attributes are key-value pairs attached to users; they drive access filters, default filters, and content validation.

Content Validation checks dashboards and Looks for broken fields or LookML errors after model changes; run it before deploying to production.

Usage and audit: the System Activity model contains history, user, and query metrics Explores for tracking adoption and slow queries.

Embedding uses signed SSO URLs or the Embed SDK; embedded users are governed by the same permissions and access filters as regular users.

Looker does not extract or cache data by default; query results are computed by the underlying database at request time.

Symmetric aggregates prevent fan-out inflation when a measure is queried across a one-to-many join.

A LookML project is stored in Git; each user has a personal Development Mode workspace branched from the shared branch.

Models contain Explores; views contain fields; the model file references views by name and defines join relationships.

Persistent Derived Tables live in a scratch schema and rebuild on a datagroup or SQL trigger, not on every query.

A primary key must be declared for symmetric aggregates and for many_to_one join accuracy.

Content types: Looks (single query), Dashboards (multiple tiles), and Boards (curated collections for teams).

Production Mode is read-only for LookML; edits require Development Mode and a deploy step.

Measure type count counts rows; count_distinct counts unique values of a field; sum and average require numeric sql.

Join relationship must match cardinality; declaring many_to_one on a one-to-many join causes inflated counts.

A datagroup with sql_trigger: SELECT MAX(updated_at) FROM table rebuilds PDTs only when the max timestamp changes.

derived_table with persist_for: '24 hours' caches results for a fixed window; datagroups are preferred for event-driven refresh.

Refinements add fields or filters to a view without modifying the original file, avoiding conflicts across projects.

access_filter: { field: view.user_id, user_attribute: company_id } restricts rows to the user's attribute value.

extends inherits fields; a child view can override a field by redefining it with the same name.

Dimension type: tier creates numeric buckets for grouping (for example, order size bands) without custom SQL CASE logic.

Pivoting a dimension converts its values into columns; measures are computed per pivot combination.

Table calculations run after query results return; row(), offset(), and running_total operate on the result set, not the database.

matches advanced filters support null, -null, and value lists for precise inclusion and exclusion.

Line charts suit continuous time series; bar and column charts suit categorical comparison; scatter shows correlation between two measures.

drill_fields on a dimension or measure define the drill path shown when a user clicks a data point.

Merged results require a shared dimension with identical name and type across both queries.

Row limits cap returned rows; totals rows can be enabled for table visualizations to show column aggregates.

Custom dimensions and measures are saved to the Explore for the user but do not alter LookML unless promoted by a developer.

Schedules deliver Looks and Dashboards on a cadence via email, webhook, or destinations such as S3 and SFTP.

Alerts require a numeric condition on a supported visualization and notify via email or webhook when met.

Folder permissions inherit from parent folders; private content is visible only to its owner until moved.

Roles: Admin manages users and settings; Developer edits LookML; Viewer consumes content only.

User attributes feed access_filter, default filter values, and content validation logic.

Content Validation flags broken fields and LookML errors across saved content after a model change.

The System Activity model exposes history, user, and query Explores for adoption and performance analysis.

Embedded users authenticate via signed SSO URLs and remain subject to access filters and role permissions.

Looker queries the warehouse live; no data is stored in Looker unless a PDT or cache is configured.

Symmetry aggregates measures over the full joined set before reducing to selected dimensions, preventing double counting.

LookML is Git-versioned; deploys move Development Mode changes to the shared production branch.

Model files define Explores and joins; view files define dimensions, measures, and their SQL.

PDTs persist to a scratch schema and refresh on a datagroup or SQL trigger.

Primary keys enable symmetric aggregates and validate many_to_one joins.

Looks, Dashboards, and Boards are the three primary content containers.

Production Mode is read-only; LookML edits happen in Development Mode per user.

Dimension types include string, number, yesno, date, time, timestamp, and tier; each affects filters and formatting.

Measure types include count, count_distinct, sum, average, min, max, list, and derived.

Join relationships: one_to_one, many_to_one, one_to_many, many_to_many; many_to_one is standard for fact-to-dimension.

sql_on enables custom join conditions; foreign_key joins on the joined view's primary key.

Datagroups with sql_trigger rebuild PDTs only when the trigger query's result changes.

Refinements (refine:) extend views without editing the source file.

access_filter injects a user attribute into every query to enforce row-level security.

extends inherits fields and allows overriding by redefining a field with the same name.

Pivots move a dimension to columns, changing result grain and enabling side-by-side measure comparison.

Table calculations evaluate post-query; functions like running_total, offset, and pivot_index operate on returned rows.

matches advanced supports null, -null, and value lists for inclusion and exclusion filters.

Chart choice: line for time series, bar/column for categories, scatter for correlation, single value for KPIs.

drill_fields define the drill path available when clicking a data point.

Merged results join queries on a shared dimension with identical name and type.

Row limits cap rows returned; totals rows aggregate columns in table visualizations.

Custom fields are user-scoped and only enter LookML when a developer promotes them.

Schedules run Looks and Dashboards on a cadence and deliver via email, webhook, or cloud destinations.

Alerts fire on numeric thresholds and require a supported visualization type.

Folder permissions inherit from parents; private content is owner-only until shared.

Admin manages users and settings; Developer edits LookML; Viewer consumes content.

User attributes drive access filters, default filters, and validation behavior.

Content Validation detects broken fields after model changes; run it before deploying.

System Activity model provides history, user, and query Explores for adoption and performance tracking.

Embedding uses signed SSO URLs; embedded users obey access filters and role permissions.

Looker runs SQL against the warehouse at query time; it stores no data by default.

Symmetric aggregates prevent fan-out inflation across one-to-many joins.

LookML is version-controlled in Git; deploys promote Development Mode changes to production.

Models define Explores and joins; views define fields and their SQL expressions.

PDTs persist to a scratch schema and refresh on a datagroup or SQL trigger.

Primary keys enable symmetric aggregates and validate join cardinality.

Looks, Dashboards, and Boards are the primary content containers.

Production Mode is read-only; LookML edits require Development Mode.

Dimension types: string, number, yesno, date, time, timestamp, tier; each affects filters and display.

Measure types: count, count_distinct, sum, average, min, max, list, derived.

Join relationships must match cardinality; many_to_one is standard for fact-to-dimension joins.

sql_on allows custom join conditions; foreign_key joins on the joined view's primary key.

Datagroups with sql_trigger rebuild PDTs only when the trigger result changes.

Refinements extend views without editing the original file.

access_filter enforces row-level security using user attributes.

extends inherits fields; redefining a field overrides the inherited definition.

Pivoting a dimension creates columns and computes measures per pivot value.

Table calculations run post-query; running_total, offset, and pivot_index operate on returned rows.

matches advanced filters support null, -null, and value lists.

Line charts suit time series; bar and column suit categories; scatter shows correlation.

drill_fields define the drill path shown when clicking a data point.

Merged results require a shared dimension with identical name and type.

Row limits cap returned rows; totals rows aggregate columns in tables.

Custom fields are user-scoped and enter LookML only when promoted.

Schedules deliver Looks and Dashboards on a cadence via email, webhook, or cloud destinations.

Alerts require numeric conditions and a supported visualization.

Folder permissions inherit from parents; private content is owner-only until shared.

Roles: Admin manages users; Developer edits LookML; Viewer consumes content.

User attributes drive access filters, default filters, and validation.

Content Validation flags broken fields after model changes.

System Activity model exposes history, user, and query Explores.

Embedding uses signed SSO URLs; embedded users obey access filters and roles.