coalesce
Cortex XDR XQL coalesce() function returns the first value that is not null from a defined list of fields.
Synopsis
coalesce (<field_1>, <field_2>,...<field_n>)
Description
The
coalesce()
function
takes an arbitrary number of arguments and returns the first value
that is not NULL.
Examples
Given a list of fields that contain usernames, select the first one that is not
null
and display it in the username
column
dataset = xdr_data | fields actor_primary_username, os_actor_primary_username, causality_actor_primary_username | alter username = coalesce(actor_primary_username, os_actor_primary_username, causality_actor_primary_username)
Recommended For You
Recommended Videos
Recommended videos not found.
