Has anyone been able to use "filter" function within the JSON result pop-up?

[krunalm]

Has anyone been able to use "filter" function within the JSON result pop-up? I've tried multiple times but I'm getting error saying invalid key, not found. Any working examples would be much appreciated! Thanks!

[Dmitry_Sarakeev]

hi @krunalm , can you please elaborate what you refer to? do you mean expression builder? i added example here what should get me a value for the case name

View files in slack

[krunalm]

Yup exactly this but using the filter function from the right-side menu

[Dmitry_Sarakeev]

ok, to me this filter returns all of the jsons from the list of jsons that have priority P4:
filter("priority", "=", "P4")]

[krunalm]

Can it return a specific field based on the value of a different field? So in your example case, it could be returning all case.Name where priority=P4?

[Dmitry_Sarakeev]

it returns full json "node" if priorirty =P4

[krunalm]

Can it have a placeholder from alert data? For example, return JSON node where "entity" = "source IP" (from alert data)