topic Create a variable with the values of a specific tag in DQL

Create a variable with the values of a specific tag

elenaperez — Fri, 14 Jul 2023 10:59:06 GMT

I would like to create a variable that contains the values of a specific tag for the hosts. I'm trying to create the query to get these values.
Basically if the tag is called Business Application and the values are X, Y, Z I would like to get X, Y and Z.I tried with this but it gives me all the tags for the different hosts:

fetch dt.entity.host
| summarize count = count(), by:{tags}
| sort count desc
| fields tags

I guess you would need to parse the individual tags and separate them if they are key:value.
How could I create this query?

Re: Create a variable with the values of a specific tag

sinisa_zubic — Fri, 14 Jul 2023 11:10:43 GMT

Hi @elenaperez

to get a list of unique tag values for the tag "Business Application" this dql query should work for you

Best,
Sini

Re: Create a variable with the values of a specific tag

elenaperez — Fri, 14 Jul 2023 11:25:43 GMT

Thank you so much, it is exactly what I was looking for! Super helpful