cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Who Me Too'd this topic

XQL Query: Issue with arrayindexof() function in host_inventory dataset

L3 Networker

Whenever we use arrayindexof() function with host_inventory dataset we get an error (Failed to run) but whereas when we run with dataset of xdr_data we get a success response message.

 

Please run the below XQL query: (Status == Success)

config case_sensitive = false
| dataset = xdr_data 
| alter sampleArray = arraycreate("ABC","DEF","GHI","JKL","MNO", "123")
| alter arrayLength = array_length(sampleArray)
| alter indexValue = arrayindexof(sampleArray,"@element" = "MNO")
| fields sampleArray, arrayLength, indexValue
| limit 10

 

Now, run the below XQL query to produce the issue: (Status == Failed)

config case_sensitive = false
| dataset = host_inventory 
| alter sampleArray = arraycreate("ABC","DEF","GHI","JKL","MNO", "123")
| alter arrayLength = array_length(sampleArray)
| alter indexValue = arrayindexof(sampleArray,"@element" = "MNO") //If you comment this line the query runs absolutely fine.
| fields sampleArray, arrayLength, indexValue
| limit 10

 

Can we please have this fixed in host_inventory dataset, we would need this in order to loop through some data inside services json array in host_inventory dataset?

 

Thank you.

 

Cortex XDR

Kind Regards
KS
Who Me Too'd this topic