Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Table of Contents
maxLevel2
typeflat

Description

Adds a new column field that reverses the contents of a string or boxarint.

How does it work in the search window?

Select Create column field in the search window toolbar, then select the Reverse operation. You need to specify one argument:

Argument

Data type

String mandatory

string

To reverse a boxarint:

Argument

Data type

Boxarint mandatory

string or boxar(int1)

The data type of the values in the new column field is string.

Info

Example 2 uses a string that represents a byte array—a regular string is not valid for this operation.

You can also run this operation with a boxarint column field

Example 1

In the siem.logtrust.web.activity table, you want to reverse the strings of the city columnfield.

The argument needed to create the new column field is:

  • String to be converted - city column field

...

Click Create column and you will see the following result:

...

field.

Example 2

To reverse the values of a boxarint you must create a byte array from a valid hexadecimal (base16) string, in this example using the correlationId column field.

...

Create a reverse boxarint from the previously-created boxar column field.

...

Once completed this is the result:

...

How does it work in LINQ?

Use the operator select... as...  and add the operation syntax to create the new columnfield. This is the syntax for the Reverse operation:

  • reverse(string)

Example

You can copy the following LINQ script and try the above example on the siem.logtrust.web.activity table:

Code Block
from siem.logtrust.web.activity
  select reverse(city) as reverse

Use the operator select... as...  and add the operation syntax to create the new columnfield. This is the syntax to reverse a boxarint:

  • reverse(string)
    or

  • reverse(boxar(int1)

Example

You can copy the following LINQ script and try the above example on the siem.logtrust.web.activity table:

Code Block
from siem.logtrust.web.activity
  select from16(correlationId) as boxar,
    reverse(boxar) as Reversed