...
Test them together in Data Search
Code Block | ||
---|---|---|
| ||
from siem.logtrust.web.activity //create a set select mkset(srcHost,params) as mkset_string select {srcHost, params} //convert an into a set select [1,2,3] as array, set(array) as toset_int, //check if the set is empty isempty(mkset_string) as isemty, //what is the length of the array length(mkset_string) as length, //does the set contain a specific item? toset_int -> 2 as has, //add values to a set "new value" + mkset_string as add_va, //join a set. Concatenates all the values of a set join(mkset_string, ",") as join_set //Get distinct values in a set out of a grouped field //group select collectdistinct(responseLength) as responseLength_sizedistinct |
...