XQL 2 Datasets

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

XQL 2 Datasets

L1 Bithead

Hello community,

I am reaching out to you after many hours of trying to get this XQL query but something is not working.

I need to join the IP address from endpoints to my query 

dataset = management_auditing
| filter description contains "SOX" and (description contains "assign tags" or description contains "remove tags")
| alter HOSTNAME = if(description contains "assign tags", ltrim(description, "Assign tags (SOX) for"), ltrim(description, "Remove tags (SOX) for"))
| alter ACTION_TYPE = if(description contains "assign tags", "Assign", "Remove")
| join ( dataset = endpoints | fields ip_address as Ipaddress) as endpoints endpoints.Ipaddress = source_ip
| fields _time, ACTION_TYPE as Tipo_Accion, HOSTNAME as Hostname, description as Actividad_Realizada, source_ip as IP, user_name, management_auditing_result as Estado_Accion


however it is not working as it is saying that the Join statement needs to be fixed,  I would appreciate your assistance with checking what could be wrong with this Query 

2 REPLIES 2

L5 Sessionator

Hi @J.Gammara, thanks for reaching us using the Live Community.

 

The "ip_address" field in the "endpoints" dataset is an array, you need to get all the values from the array first to compare the values.

 

You can check the dataset schemas by running a query to the dataset without any other stage, and going to the "Schema" tab:

jmazzeo_1-1737403787329.png

 

If this post answers your question, please mark it as the solution.

JM

Thank you so much for your reply, 

what happens if the field is an array? what function should I use in that situation or where can I read more about it ?

  • 199 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!