XQL Query: Issue with arrayindexof() function in host_inventory dataset

KanwarSingh01 — Thu, 23 Feb 2023 00:25:34 GMT

Whenever we use arrayindexof() function with host_inventory dataset we get an error (Failed to run) but whereas when we run with dataset of xdr_data we get a success response message.

Please run the below XQL query: (Status == Success)

Now, run the below XQL query to produce the issue: (Status == Failed)

config case_sensitive = false | dataset = host_inventory | alter sampleArray = arraycreate("ABC","DEF","GHI","JKL","MNO", "123") | alter arrayLength = array_length(sampleArray) | alter indexValue = arrayindexof(sampleArray,"@element" = "MNO") //If you comment this line the query runs absolutely fine. | fields sampleArray, arrayLength, indexValue | limit 10

Can we please have this fixed in host_inventory dataset, we would need this in order to loop through some data inside services json array in host_inventory dataset?

Thank you.

Re: XQL Query: Issue with arrayindexof() function in host_inventory dataset

zarnous — Fri, 24 Feb 2023 17:10:44 GMT

I have also tried that in a built in field in the host_inventory dataset and still return an error, hence, i recommend having a TAC case created so we get a better look at the backend and dataset configuration.

topic Re: XQL Query: Issue with arrayindexof() function in host_inventory dataset in Cortex XDR Discussions

XQL Query: Issue with arrayindexof() function in host_inventory dataset

Re: XQL Query: Issue with arrayindexof() function in host_inventory dataset