Hi, Thanks!!! That query works fine. I think that I have two problems. The first one is that you comment with the merge about the nic id and the vm id. But, I think that the real problem form my query is in the tests that I made before, when the filter and variable syntaxis was wrong. In the filter phrasse need to use a double quote "" and the X, Y and Z variables need to be called with ['X']. Regards.
... View more
Hello, I have an error when we are implementing a RQL query in the Investigate tab. We make a join query searching in a VMs list and a NICs list in the prisma platform over a Azure suscription. The problem seems to be over the filter part when we use the ['xxx.xxx'] format in a query when an atribute have a dot inside, because when we change to other atribute that don't have dot, it runs. The query is the next (we are checking the atributes to correlate the VMs): config where api.name = 'azure-network-nic-list' as X; config where api.name = 'azure-vm-list' as Y; filter '$.X.['properties.virtualMachine'].id == $.Y.['properties.networkProfile'].networkInterfaces[*].id and $.X.tags.owner exists'; show X; Do anyone know if the definition over the filter could be different that in the filter body? Is it any separating character that allow the query? Could be a bug in the prisma platform? Regards.
... View more