XQL Query: Issue with arrayindexof() function in host_inventory dataset

[KanwarSingh01]

Whenever we use arrayindexof() function with host_inventory dataset we get an error (Failed to run) but whereas when we run with dataset of xdr_data we get a success response message.

Please run the below XQL query: (Status == Success)

config case_sensitive = false
| dataset = xdr_data 
| alter sampleArray = arraycreate("ABC","DEF","GHI","JKL","MNO", "123")
| alter arrayLength = array_length(sampleArray)
| alter indexValue = arrayindexof(sampleArray,"@element" = "MNO")
| fields sampleArray, arrayLength, indexValue
| limit 10

Now, run the below XQL query to produce the issue: (Status == Failed)

config case_sensitive = false
| dataset = host_inventory 
| alter sampleArray = arraycreate("ABC","DEF","GHI","JKL","MNO", "123")
| alter arrayLength = array_length(sampleArray)
| alter indexValue = arrayindexof(sampleArray,"@element" = "MNO") //If you comment this line the query runs absolutely fine.
| fields sampleArray, arrayLength, indexValue
| limit 10

Can we please have this fixed in host_inventory dataset, we would need this in order to loop through some data inside services json array in host_inventory dataset?

Thank you.

Cortex XDR

[zarnous]

I have also tried that in a built in field in the host_inventory  dataset and still return an error,  hence, i recommend having a TAC case created so we get a better look at the backend and dataset configuration.