topic Re: Accessing Tags in XQL in General Topics

Accessing Tags in XQL

ianatgrafton — Thu, 06 Oct 2022 13:15:31 GMT

I can see that tags are exposed on the endpoints dataset in XQL but when I inlcude them in a query they appear (vaguely) as key value pairs thus:

"endpoint tags": [], "server_tags":["IAN"]

The schema though reports tags as being of type string and not an array

I would like to be able to extract just the server tag value(s) and present that in an XQL query, is that possible?

Re: Accessing Tags in XQL

ianatgrafton — Thu, 06 Oct 2022 13:39:44 GMT

I have this working, but it still returns the value in double quotes. I've no idea if there is a btter way to a cheive thgis nor if it possible to remove the quotes but this works for me for now

dataset = endpoints | alter server = json_extract(tags,"$.server_tags") | alter server = trim(server,"[]") | fields endpoint_name as Host_Name, agent_version as Version, server as Server_Tag