XQL Query: Issue with arrayindexof() function in host_inventory dataset

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

XQL Query: Issue with arrayindexof() function in host_inventory dataset

L3 Networker

Whenever we use arrayindexof() function with host_inventory dataset we get an error (Failed to run) but whereas when we run with dataset of xdr_data we get a success response message.

 

Please run the below XQL query: (Status == Success)

config case_sensitive = false
| dataset = xdr_data 
| alter sampleArray = arraycreate("ABC","DEF","GHI","JKL","MNO", "123")
| alter arrayLength = array_length(sampleArray)
| alter indexValue = arrayindexof(sampleArray,"@element" = "MNO")
| fields sampleArray, arrayLength, indexValue
| limit 10

 

Now, run the below XQL query to produce the issue: (Status == Failed)

config case_sensitive = false
| dataset = host_inventory 
| alter sampleArray = arraycreate("ABC","DEF","GHI","JKL","MNO", "123")
| alter arrayLength = array_length(sampleArray)
| alter indexValue = arrayindexof(sampleArray,"@element" = "MNO") //If you comment this line the query runs absolutely fine.
| fields sampleArray, arrayLength, indexValue
| limit 10

 

Can we please have this fixed in host_inventory dataset, we would need this in order to loop through some data inside services json array in host_inventory dataset?

 

Thank you.

 

Cortex XDR

Kind Regards
KS
1 REPLY 1

L2 Linker

I have also tried that in a built in field in the host_inventory  dataset and still return an error,  hence, i recommend having a TAC case created so we get a better look at the backend and dataset configuration. 

Z
  • 879 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!