06 Aug 2025 07:43 PM - edited 06 Aug 2025 07:44 PM
I have two multi-select variables, "Scope" which contains values used in dt.entity.host names and then "Hosts" which I would like to filter based on selected "Scope" values.
Scope:
Hosts:
My goal would be to gather all hosts that contain the selected "Scope" values.
fetch dt.entity.host
// I've tried a combination of the following:
| filter matchesValue(entity.name, Array($Scope))
| filter in(entity.name, Array($Scope))
Maybe I'm missing something. Any help would be greatly appreciated. Thanks in advance for any consideration!
07 Aug 2025 03:21 AM
@Edjumacator Can you please try below for hosts as an example and see if it helps?
fetch dt.entity.host
| filter matchesPhrase(entity.name,$Scope)
| fields entity.name
11 Aug 2025 05:55 PM
@p_devulapalli It works for a single selection of my scope, however, if I select multiple choices in scope, it doesn't seem to work. Is there a way to pass an array of values to be matched against?
Scope:
✅AWS
☑️WEB
✅APP
Hosts (Populates with)
AWS-CA...
AWS-WV...
CAPP-1
CAPP-2
12 Aug 2025 06:44 AM
@Edjumacator Can you please try below and see if it helps
fetch dt.entity.host
| filter in(entity.name, {$Scope})
| fields entity.name
12 Aug 2025 06:38 AM
I've gotten it to work doing something like this:
| filter matchesValue(entity.name, {$Scope})
12 Aug 2025 03:29 PM
@siavash1996 I have given that a shot but nothing appears to be working.
If I select WEB, and run the query below:
// Example of what works:
fetch dt.entity.host
| fields host = entity.name
| filter matchesValue("*", {$Scope})
or (matchesValue("AWS", {$Scope}) and contains(host, "AWS"))
or (matchesValue("WEB", {$Scope}) and contains(host, "WEB"))
or (matchesValue("APP", {$Scope}) and contains(host, "APP"))
| sort host
| fields host
That returns
// Example of what I'm shooting for:
fetch dt.entity.host
| fields host = entity.name
| filter matchesValue("*", {$Scope})
or matchesPhrase(host, {$Scope}, caseSensitive:false)
| sort host
| fields host
I am hoping to be able to write a matchesValue, matchesPhrase, in, or contains that doesnt require me to manually update this variable everytime I add something to the scope.
or (matchesValue("AWS", {$Scope}) and contains(host, "AWS"))