- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
01-20-2025 08:46 AM
Hello community,
I am reaching out to you after many hours of trying to get this XQL query but something is not working.
I need to join the IP address from endpoints to my query
dataset = management_auditing
| filter description contains "SOX" and (description contains "assign tags" or description contains "remove tags")
| alter HOSTNAME = if(description contains "assign tags", ltrim(description, "Assign tags (SOX) for"), ltrim(description, "Remove tags (SOX) for"))
| alter ACTION_TYPE = if(description contains "assign tags", "Assign", "Remove")
| join ( dataset = endpoints | fields ip_address as Ipaddress) as endpoints endpoints.Ipaddress = source_ip
| fields _time, ACTION_TYPE as Tipo_Accion, HOSTNAME as Hostname, description as Actividad_Realizada, source_ip as IP, user_name, management_auditing_result as Estado_Accion
however it is not working as it is saying that the Join statement needs to be fixed, I would appreciate your assistance with checking what could be wrong with this Query
01-20-2025 12:10 PM
Hi @J.Gammara, thanks for reaching us using the Live Community.
The "ip_address" field in the "endpoints" dataset is an array, you need to get all the values from the array first to compare the values.
You can check the dataset schemas by running a query to the dataset without any other stage, and going to the "Schema" tab:
If this post answers your question, please mark it as the solution.
01-20-2025 01:22 PM
Thank you so much for your reply,
what happens if the field is an array? what function should I use in that situation or where can I read more about it ?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!