Description
This operation identifies a correctly formatted string as a namepattern - a required input for the Any name matches (anymatches) operation. This is the only use for this operation.
Used together, these operations are used to filter the tables column after running a global search. Read more about this in the Any name matches (anymatches) article.
| Info |
|---|
About glob name patterns Glob name patterns use asterisks as wildcards to allow you to identify any table whose name matches a pattern. The accepted syntax for glob patterns in Devo include:
You can see that a single asterisk is a wildcard for part of or a whole level of a table name, while two asterisks represent any number of levels. You must include "." in the glob pattern to guide the search. |
...
The nameglob operation is only used as part of the Any name matches (anymatches) operation. Therefore, the valid use of nameglob as part of the Any name matches operation is as follows:
...
Note that the only setname_field that exists in any data table is the tables field in the all.data table (global search results).
Examples
Run a global search for the token "logtrust". The all.data table opens in the search window.
Now open the Query Editor and edit the query by adding the last line below:
| Code Block |
|---|
from all.data
where toktains(message, "logtrust")
where anymatches(tables, nameglob("siem.**")) |
...