DQL variable with tag values stopped working

[MarcioKaue]

Hello,

We were using a Dashboard with a selector filter that has the existing values of a tag in our hosts for the use case of this Dashboard, but this week the DQL query using the variable stopped working (before it was working normally).

Query DQL:

fetch dt.entity.host
| fieldsAdd tags
| expand tags
| summarize tags = collectDistinct(tags)
| expand tags
| parse tags, """((LD:tag (!<<'\\' ':')LD:value) |LD:tag)"""
| fields tag = replaceString(tag, """\:""", ":"), value = replaceString(value, """\:""", ":")
| filter toString(tag) == "MyTag"
| fields value

Could anyone support?

[Fin_Ubels]

Hey Marcio,

I ran the same query in my environment and it is working just fine. Could you provide some context as to what about it isn't working and what its purpose is?

In my below example I tagged a synthetic with "Test:SomeTag" and the query, as expected, returns "SomeTag" when the input tag string is "Test":

[MarcioKaue]

Hello @Fin_Ubels ,

I need to bring all the values of a tag to use as a variable in a Dashboard.

Here is an example, if I even use the "parse" function, the DQL returns all tags and values

If I filter by a tag value, the error I mentioned occurs:

[Fin_Ubels]

Hey Marcio,

For such an error I would suggest opening a support ticket if you haven't already so that they can look deeper behind the scenes.

In the meantime, would a different query like this work in your situation?

[MarcioKaue · Accepted solution]

I was able to identify that the "fields" function for some reason was not being accepted (the error message is not clear as to why).

Here is the DQL that brings the same result in another way:

fetch dt.entity.host
| expand tags
| summarize tags = collectDistinct(tags)
| expand tags
| parse tags, """((LD:tag (!<<'\\' ':')LD:value) |LD:tag)"""
| fieldsAdd tag = replaceString(tag,"""\:""", ":"), value = replaceString(value, """\:""", ":")
| filter toString(tag) == "MyTag"
| fieldsRemove tags, tag