06 Jan 2025 03:35 PM - last edited on 07 Jan 2025 02:17 PM by MaciejNeumann
06 Jan 2025 05:49 PM
You can do something like this to get a list of services where the hosts that run them have a certain tag.
fetch dt.entity.service
| expand dt.entity.host=runs_on[dt.entity.host]
| fieldsAdd entityAttr(dt.entity.host, "tags")
| filter matchesPhrase(dt.entity.host.tags, "App:apptag")
| dedup id
| fields entity.name, id