XQL Query help is required to narrow down our requirement

[VenuK]

Dear All,

We are trying to understand that, there are certain applications installed on a host by using the below query. preset = host_inventory_applications
|filter endpoint_type = "AGENT_TYPE_WORKSTATION"
|filter application_name in("Application A","application B", "Application C") 
| comp latest(report_timestamp) by endpoint_name, application_name
| dedup endpoint_name, application_name
| sort asc endpoint_name  
| fields endpoint_name, application_name 

By running the above query, the result is that, we are getting hostname, application name etc, but we would like to get the result like the below.

Host Name, Applicatioin A, Application B etc, instead of duplicate entries of host with different applications.

[bbucao · Accepted solution]

Hi VenuK,

Try using the values function in the comp stage like in the example below. This will give you a field for each endpoint with an array of the applications 

preset = host_inventory_applications
|filter endpoint_type = AGENT_TYPE_WORKSTATION
|filter application_name in("Application A","application B", "Application C")
|comp values(application_name) as installed_applications by endpoint_name

Thanks,
Ben

[VenuK]

You are really awesome @bbucao , this works