How do normalize computer name from different data sources?
I need to compare data from two different data sources. What's the best why to normalize the data. In one source it's uppercase computer name and sometimes has the domain like contra\lt-fun. Can normalization be applied at ingest or does that have to be in each and every query?
I'm trying to avoid having to always add something like this in my query:
=UPPER(IF(ISNUMBER(FIND("\",B15)),RIGHT(B15,(LEN(B15)-3)),B15))
I'm trying to avoid having to always add something like this in my query:
=UPPER(IF(ISNUMBER(FIND("\",B15)),RIGHT(B15,(LEN(B15)-3)),B15))
0
Answers
-
Hi, thanks for your question! Data normalization is applied at ingestion and our integration documents provide insight into naming conventions for each entity. In some cases this leads to longer queries with or clauses or optional traversals. We have compiled a few tutorials and guides here: https://community.askj1.com/kb/categories/648-jupiterone-query-language-j1ql0
This Month's Leaders
Categories
- 336 All Categories
- Featured Categories
- 7 About the AskJ1 Community
- 11 Product Announcements
- From Mission Control
- 1 Rapid Response
- 3 How J1 Uses J1
- Topics
- 131 Asset Management
- 56 Compliance & Reporting
- 65 Security Operations
- 40 Security Engineering
- 5 Open Source
- 18 News, Careers and More