topic Expanding Multiple arrays in DQL

Expanding Multiple arrays

Javin_Singh — Fri, 22 Nov 2024 10:17:31 GMT

I am trying to expand multiple arrays in 3 separate columns ("Host_Metric", "Start" and "End"). Each array in all 3 columns has 97 elements.

I am trying to expand each of the arrays into records. However, when I used the "expand" command, each array element keeps multiplying with the elements of the other arrays, creating many duplicates with wrong information.

I simply want to expand all 3 arrays into their corresponding 97 records with their indexes in the same order. Is this possible?

Re: Expanding Multiple arrays

Tiit_Hallas — Mon, 25 Nov 2024 08:17:24 GMT

Do I understand you correctly that:

1. you have three arrays: a = [1,2] , b = [3,4] , c = [5,6]
2. you expect the output to be:

a | b | c --------- 1 | 3 | 5 2 | 4 | 6

if so, the iCollectArray function and the following query can help you:

data record( a = array(1,2,3), b = array(4,5,6), c = array(7,8,9) ) | fields all = iCollectArray(record(first = a[], second = b[],third = c[])) | expand all | fieldsFlatten all

I created a demo for you in the Security investigator in our Playground as well, you can access it at https://wkf10640.apps.dynatrace.com/ui/apps/dynatrace.security.investigator/share/4c1b0392-60fc-4d21-aebb-0c3dd8ace1f5

Does this solve your problem?

Re: Expanding Multiple arrays

Javin_Singh — Mon, 25 Nov 2024 08:39:19 GMT

Thank you. This solved my problem.