| Table of Contents | ||||
|---|---|---|---|---|
|
Description
You can apply this operation either as a Filter or Create field operation:
Filter | Returns only those strings that contain a specified value, ignoring case. |
|---|---|
Create field | Creates a Boolean field that shows true when the indicated value is present in the given string, ignoring case. |
| Note |
|---|
Use the Contains (has, ->) operation if you need to discriminate between uppercase and lowercase letters. |
How does it work in the search window?
Select Filter / Create field in the search window toolbar, then select the Contains - case insensitive operation. You need to specify two arguments:
Argument | Data type |
|---|---|
Value mandatory | string |
contains (ignoring case) mandatory | string |
If you use the Create field operation, the data type of the values in the new field is boolean (true or false).
| Info |
|---|
You can also use the Is in - case insensitive (weakin) operation to check for the presence of values in a given string, the only difference is the order of the arguments. The Is in - case insensitive operation requires you to first indicate the value(s) to check and then the general string (value IS IN string), and the Contains - case insensitive operation works the other way around (string CONTAINS value). |
Example
In the siem.logtrust.web.activity table, we want to get only the events that contain Mozilla in the userAgent column. To do it, we will apply a Filter using the Contains - case insensitive operation.
| Note |
|---|
Active case insensitive Some operations have a case sensitive and a case insensitive version, for example, Contains - case insensitive (weakhas) and Contains (has, ->). Use these options to display only the sensitive or insensitive versions of these operations, or choose all to show both versions. Operations that don't have a sensitive and insensitive version will be visible regardless of the option selected. You can select the default option in your User preferences, and Admin users can do the same for all the users in the domain in their Domain preferences. |
...
Click Filter data and you will see the following result:
...
Click Create field and follow the same steps to add a new Boolean field that shows true when the values in the userAgent field contain mozilla (ignoring case).
How does it work in LINQ?
...
weakhas(string_general, string_value)
Examples
You can copy the following LINQ script and try the above example on the demo.ecommerce.data table:
| Code Block |
|---|
from demo.ecommerce.data where weakhas(userAgent, "mozilla") |
And this is the same example using the Create column operation:
| Code Block |
|---|
from demo.ecommerce.data select weakhas(userAgent, "mozilla") as has_mozilla_ins |
You can also apply this operation using the ->> operator. However, this syntax does not admit more than two arguments, so you can only add a single value to be searched in the selected string field. In the following examples, we want to detect events containing Mozilla in the userAgent column:
| Code Block |
|---|
from demo.ecommerce.data select userAgent select userAgent ->> "mozilla" as has_mozilla_ins |