I want to assign department names to each feed id using a data table

Just a quick question, is there a reason why you’re not adding the department as an ingestion label for each feed instead of trying to calculate this after ingestion? You could modify each feed and add an ingestion label with a key of “Department” and a value of “C” or “A”, etc...

Thank you for your reply.

We also tested the method of assigning labels, but when the log type is "ingestion.log_type", the label field could not be used.
Therefore, we are using the feed_id field instead.

We have also verified that similar behavior can be reproduced using "namespace", but we asked this question to find out whether it is technically possible to use data tables to categorize departments for future reference.

I see what you’re saying. You’re using the ingestion dataset instead of the UDM event dataset for the dashboard and the ingestion_label isn’t carried over from the UDM events to the ingestion dataset.

I don’t think it’s possible to join a data table to anything other than  UDM Event (Search/Dashboards) or an Entity (Dashboards), but I’ll verify. You could continue down the path of the conditional statement and instead of using a data table, hard code the feed IDs into the query. It’s not ideal, but would work.

If you have Google SecOps Ent+, which has managed Big Query, you could create something with that dataset to be able to join.

Thank you for your reply and investigation.

I also appreciate your efforts in verifying whether the data table can be used to combine information. Sorry for the trouble, but I’d be grateful if you could share the results once they’re available.

I validated that it’s currently not possible to join a data table to the ingestion dataset, only UDM events/entities. Below is an example of hard coding the feed id's, again, not ideal but works.

ingestion.log_type = "CISCO_MERAKI"

$Department = if(ingestion.feed_id = "Feed ID", "A" ,
              if(ingestion.feed_id = "Feed ID", "B", 
              if(ingestion.feed_id = "Feed ID", "C")))

match:
ingestion.feed_id, $Department

outcome:
$Volume = math.round(sum(ingestion.log_volume) / (1000), 2)

order:
$Volume desc