XQL Question - Aggregation by field of type array is unsupported

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

XQL Question - Aggregation by field of type array is unsupported

L0 Member

I'm trying to run a query to get a count of how many times combinations of the values in "initiated_by" and "initiator_path" occur for an alert in the alerts dataset.

For example:

binary1.exe  c:\temp\blah 6
binary2.exe c:\temp\blahblah 12

I'm trying to use this search, but I get the error in the title "Aggregation by initiated_by field of type array is unsupported."

dataset = alerts
| filter alert_name = "Execution From a Restricted Location"
| fields + alert_name, initiated_by, initiator_path
| comp count_distinct(initiator_path) as initiator_path_count by initiated_by


Is there a way I can get a count of the initiated_by and intitiator_path values, or can I only do that in things that are not an "array" in the schema? 

1 REPLY 1

L4 Transporter

Hello @jessecleary 

 

Thanks for reaching out on LiveCommunity!

Yes, the aggregation of data by field type array is not supported. In order to see the unique value count of an array you can use arraydistinct() function. I have a created an example query below. Please modify it according to your use case.

dataset = alerts
| filter alert_name = "Execution From a Restricted Location"
| fields alert_name, initiated_by, initiator_path
| alter xyz= arraydistinct(initiator_path )
| fields alert_name, xyz
| comp count(xyz) by alert_name

 

 

  • 752 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!