topic Re: host inventory - Disk Space XQL - bytes conversion not possible because of string - to_number? in Cortex XDR Discussions

host inventory - Disk Space XQL - bytes conversion not possible because of string - to_number?

RFeyertag — Wed, 21 Sep 2022 13:45:03 GMT

Hello dear community,

how can we get this use case running? I need to know which disk is running lower than 5 GB.

In my case I have a conversion problem, because the field free_space is a string. How can I convert it to a number, so I can divide it to GB?

config case_sensitive = false
|dataset = host_inventory
| arrayexpand disks
| alter disks = json_extract(disks, "$.name"), free_space = json_extract(disks, "$.free_space"), size = json_extract(disks, "$.size")

//| alter free_space_KB = divide(free_space, 1024) // convert bytes to KB
//| alter free_space_MB = divide(free_space_KB, 1024) // convert KB to MB
//| alter free_space_GB = divide(free_space_MB, 1024) // convert MB to GB
//|alter total_upload_GB_rounded = round(free_space_GB)
//| filter applications contains $Software

| fields host_name, disks , free_space, size, ip_addresses
| sort desc free_space

I have also seen, that the fields are all strings and I cannot do any calculations <>.

Rob

Re: host inventory - Disk Space XQL - bytes conversion not possible because of string - to_number?

tyler_bailey — Wed, 21 Sep 2022 13:55:54 GMT

Rob,

You can use the to_integer() function available in XQL to convert a string to an integer.

config case_sensitive = false | dataset = host_inventory | arrayexpand disks | alter disks = json_extract(disks, "$.name"), free_space = to_integer(json_extract(disks, "$.free_space")), size = json_extract(disks, "$.size") | alter free_space_KB = divide(free_space, 1024) // convert bytes to KB | alter free_space_MB = divide(free_space_KB, 1024) // convert KB to MB | alter free_space_GB = divide(free_space_MB, 1024) // convert MB to GB | filter free_space_GB < 5

Hope this helps!

Tyler

Re: host inventory - Disk Space XQL - bytes conversion not possible because of string - to_number?

RFeyertag — Wed, 21 Sep 2022 14:17:42 GMT

Thank you tyler! I took the wrong datatype :/.

Rob