1

I am working with some data and building a list of queries based upon what incident_source. This was working fine when I didn't have variable added to it which requires the + symbols. When I added that I am getting: TypeError: can only concatenate str (not "list") to str. Does anyone know a way around this or a better solution?

source = 1
offense_id = [122,153,142]
incident_source = ['source_1', 'source_2']
num_searches_by_id = []
queries_needed_ran = []

for i,j in zip(incident_source, offense_id):
    if i == 'source_1':
        data = ['''SELECT QIDNAME(qid) AS 'Event Name',"Request Method" FROM events WHERE URL=REPLACEFIRST('hxxp',''' + "'" + source + "'" + ''','http') START ''' + str(start_time) + '''-43200000''',
                '''select QIDNAME(qid) as 'Event Name', "Recepient" from events where ( "URL"=''' + "'" + str(source) + "'" + '''AND logSourceId='1' ) START ''' + str(start_time) + '''-43200000''']
        num_searches_by_id.append(len(data))
        for x in data:
            queries_needed_ran.append(x)
            
    elif i == 'source_2':
        data = ['''select QIDNAME(qid) as 'Event Name', "Recepient" from events where ( "URL"=''' + "'" + str(source) + "'" + '''AND logSourceId='1' ) START ''' + str(start_time) + '''-43200000''']
        num_searches_by_id.append(len(data))
        for x in data:
            queries_needed_ran.append(x)
    else:
        num_searches_by_id.append(0)


runfile('/Users/thomas.gorman/Documents/Python Connectors/riskiq_passivetotal/untitled20.py', wdir='/Users/thomas.gorman/Documents/Python Connectors/riskiq_passivetotal')
Traceback (most recent call last):

  File "/Users/me/Documents/Python Connectors/untitled20.py", line 427, in <module>
    data = ['''SELECT QIDNAME(qid) AS 'Event Name',"Request Method" FROM events WHERE URL=REPLACEFIRST('hxxp',''' + "'" + source + "'" + ''','http') START ''' + str(start_time) + '''-43200000''',

TypeError: can only concatenate str (not "list") to str`

Expected output:

num_searches_by_id = ['''SELECT QIDNAME(qid) AS 'Event Name',"Request Method" FROM events WHERE URL=REPLACEFIRST('hxxp',''' + "'" + source + "'" + ''','http') START ''' + str(start_time) + '''-43200000''',
                '''select QIDNAME(qid) as 'Event Name', "Recepient" from events where ( "URL"=''' + "'" + str(source) + "'" + '''AND logSourceId='1' ) START ''' + str(start_time) + '''-43200000''',
'''select QIDNAME(qid) as 'Event Name', "Recepient" from events where ( "URL"=''' + "'" + str(source) + "'" + '''AND logSourceId='1' ) START ''' + str(start_time) + '''-43200000''']
7
  • What is source? And what is your expected output? Commented Mar 5, 2021 at 0:50
  • Your question isn't clear. What is an input that actually causes the error, and what is the full traceback of the error you encounter? The bit of the error you posted implies that your input is a list, rather than a string in a list, at the point the error occurs. Commented Mar 5, 2021 at 0:52
  • source = 1 @PacketLoss Commented Mar 5, 2021 at 0:59
  • @G. Anderson My question is, I can loop through a list that does NOT contain a '+ <variable> +', but when I add a '+ <variable> +', I get a TypeError: can only concatenate str (not "list") to str Commented Mar 5, 2021 at 1:01
  • 1
    Ah.. you seem to want source to indicate the source specified in the list. You can access this via i which you defined in the opening of your loop. Commented Mar 5, 2021 at 1:07

1 Answer 1

2

So I'm not sure about some of your variables and where they are coming from, but I got rid of the TypeError: can only concatenate str (not "list") to str by placing brackets for the index your looking for in your if statement and changing the variables. Also not sure where start_time is coming from...

offense_id = [122,153,142]
incident_source = ['source_1', 'source_2']
num_searches_by_id = []
queries_needed_ran = []

for i,j in zip(incident_source, offense_id):
    if i == 'source_1':
        data = ['''SELECT QIDNAME(qid) AS 'Event Name',"Request Method" FROM events WHERE URL=REPLACEFIRST('hxxp',''' + "'" + incident_source[0] + "'" + ''','http') START ''' + str(start_time) + '''-43200000''',
                '''select QIDNAME(qid) as 'Event Name', "Recepient" from events where ( "URL"=''' + "'" + str(incident_source[0]) + "'" + '''AND logSourceId='1' ) START ''' + str(start_time) + '''-43200000''']
    num_searches_by_id.append(len(data))
    for x in data:
        queries_needed_ran.append(x)
        
    elif i == 'source_2':
        data = ['''select QIDNAME(qid) as 'Event Name', "Recepient" from events where ( "URL"=''' + "'" + str(incident_source[1]) + "'" + '''AND logSourceId='1' ) START ''' + str(start_time) + '''-43200000''']
        num_searches_by_id.append(len(data))
        for x in data:
            queries_needed_ran.append(x)
    else:
        num_searches_by_id.append(0)
Sign up to request clarification or add additional context in comments.

2 Comments

I totally get it now. So before it was working fine with queries without variables from a list. Now that its pulling data from a list I way trying to pass that list as a string. WOW. should have been using the index of the list as a string :). Thank you!
No worries. I put the actual value for you to see, but @PacketLoss is correct that you could simply pass i due to your conditional. Also, Qradar should be able to handle the SQL constructions if you are using their API

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.