Skip to content

Global Queries - Is possible to define which one to use based for example on the value of a Grafana variable, dynamically? #922

Closed Answered by canob
canob asked this question in Q&A
Discussion options

You must be logged in to vote

Ended using UQL, in this way:

parse-json
| project "resources"
parse-json
| extend "IOC_type"="type", "IOC_value"="value", "timestamp"=todatetime("created_on")
| extend "customer"=strcat('$customer')
| extend "customer_id"=extract('(.*) - .*',1,'$customer')
| extend "tech"=strcat('Crowdstrike')
| extend "device"=strcat("customer_id",' - ', "tech")
| where "IOC_type" in (${list_type:singlequote})
| where "device" in (${device:singlequote})
| where "tech" in (${technology:singlequote})
| project "IOC_type", "IOC_value", "timestamp", "customer", "device"

With this, I can create the customer name dynamically. Maybe is not going to be enough if I need really different UQL queries, to obtain …

Replies: 1 comment

Comment options

You must be logged in to vote
0 replies
Answer selected by canob
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
None yet
1 participant