How to include two or more sources in one search query
@mrahulbb You can use AND operator to search more than one source.
For example:
- source.name:“Workday” AND source.name:“Active Directory”
- @accounts(source.name:“Workday”) AND @accounts(source.name:“Active Directory”)
If you give what usecase you want to build the query and will try to create that.
Hope this Helps.
how many sources can we include
I am working on this searchquery i need to include all the sources how can i do this
attributes.cloudLifecycleState:postterm AND @accounts(source.name:“AAD” AND disabled:false)
Hello, Can you be more specific? if it is about including all sources if you give mroe details we could help you more
You can use asterisk(*) sign to returns all search data.
Try Query - attributes.cloudLifecycleState:postterm AND @accounts(source.name: * AND disabled:false)
Tried this query it shows the accounts with disabled = true in any source.
@accounts(source.name:* AND disabled:true)
i need to check the identity with lifecycle state is terminated or post term and account is enabled
i need to check the identity with lifecycle state is terminated or post term and account is enabled
please let me know your inputs on this
You can use the below query and achieve.
attributes.cloudLifecycleState:postterm AND @accounts(source.name:* AND disabled:true)
ok then, i think i am on right qurey
Yep, pls try this and lmk if it works.
I think it’s giving me exact output
output is not expected
Please elaborate your requirement with what you are trying to achieve, what have you tried so far? Did you get any errors? If so, what are they?
If not, how is the result different from what were you expecting
there is no need to add this as without it all sources will be included
1 Like
we have 10 sources need to include how can i combine in one query
Do you need to get identities that have “accounts in all” or “in any one of” 10 sources
i need get all the 10 sources identities details
we have 40 sources and i need to get only 10 sources details