...
Test them together in Data Search
| Code Block | ||
|---|---|---|
| ||
from siem.logtrust.web.activity
//create a set
select mkset(srcHost,params) as mkset_string
select {srcHost, params}
//convert an into a set
select [1,2,3] as array,
set(array) as toset_int,
//check if the set is empty
isempty(mkset_string) as isemty,
//what is the length of the array
length(mkset_string) as length,
//does the set contain a specific item?
toset_int -> 2 as has,
//add values to a set
"new value" + mkset_string as add_va,
//join a set. Concatenates all the values of a set
join(mkset_string, ",") as join_set
//Get distinct values in a set out of a grouped field
//group select collectdistinct(responseLength) as responseLength_sizedistinct |
...
Operation | Description | Syntax | Example | Result Value | Result Type |
|---|---|---|---|---|---|
Creates an array from elements | mkarray (ele_1, … ,ele_n) | mkarray (1.33,2,3,4) mkarray (“One", "two", "Number 3“) [ “One", 77 ] mkarray (domain, responseTime) | [1.33, 2, 3, 4] | array(float) array(str) array(str) array(str) | |
Creates an array by splitting a string field | split (string, string) |
| [1, 2, 3, 4] | array | |
Checks if an array is empty | isempty (array) | isempty ([1, 2, 3]) isempty ([ ]) | false true | bool | |
Returns the length of an array | length (array) | length ([1, 2, 3, 4, 5, 6]) | 6 | Int | |
Checks the occurrence of a specified value in a given array | •has (array, ele) •array -> ele | has ([30, 2, 77], 77) [30, 2, 77] -> 77 | true true | bool | |
Checks the occurrence of a specified value in a given array | `in` (ele, array) ele <- array | `in` (77, [30, 2, 77]) 77 <- [30, 2, 77] | true true | bool | |
Appends some value to the end of an array | add (array, ele) | add ([30, "Peter", 77], "Ann") | [30, Peter, 77, Ann] | array(str) | |
Concatenates two arrays | add (array_1, array_2) | add ([5, "Peter", 77], [77, "Ann", 400]) | [5, Peter, 77, 77, Ann, 400] | array(str) | |
Joins the strings of a given | join (array_str) | join ([1, "Peter", 77, 77, "Ann"]) | 1Peter7777Ann | str | |
Returns the n-th element of | at (array, n) | at ([10, 20, 3.33, 40], 1) | 20 | float | |
Returns a subarray between | at (array, from, to) | at ([10, 20, 30, 40], 1, 3) | [20, 30] | array(int) | |
Returns the index of the first | indexof (array, ele) | indexof ([10, 20, 3.33, 40], 3.33) | 2 | int | |
Drops null elements of a given array | dropnulls (array) | dropnulls ([3, null, 77, null]) | [3, 77] | array(int) | |
Sorts the elements of a | sort (array) | sort ([3, 77, 30, 1) | [1, 3, 30, 77] | array(int) | |
Reverses the elements of | reverse | reverse ([3, 77, 30, 1) | [1, 30, 77, 3] | array(int) | |
Sums the values of a | sum (array) | sum([1,2,3,4]) | 10 | Int |
...