Variable: display only part of the value

aled — Mon, 01 Jul 2024 10:59:05 GMT

I have a variable defined as such:

which is practical because later on, when the variable is used, I can use the value as-is without transformations

However, this display values as "[AWS]environment:prod", which I find to be quite bad UX
With a query like:

I can get only my values, but the variable is hard to use as it is not the complete tag

Is there a way to display only the value and get the tag? Or a good way to transform from one to the other later on (while using multi-select)?

Re: Variable: display only part of the value

krzysztof_hoja — Fri, 28 Jun 2024 20:43:24 GMT

You can parse out complete information from tag string. Here is just a bit more complex query getting all parts of tag:

fetch dt.entity.host | fields tags | expand tags | parse tags, """(('[' , LD:tag.context , ']' , LD:tag.name ) | LD:tag.name) ':' LD:tag.value""" | summarize { tag.values=collectDistinct( tag.value ) }, by: { tag.context, tag.name } | fieldsAdd tag.values.size = arraySize(tag.values)

summarizing all possible contexts (even if not present) and tag names. Result looks like this:

topic Re: Variable: display only part of the value in DQL

Variable: display only part of the value

Re: Variable: display only part of the value