Contains (has, ->)

[ 1 Description ] [ 2 How does it work in the search window? ] [ 3 How does it work in LINQ? ]

Description

You can apply this operation either as a Filter or Create field operation:

Filter	Checks for the presence of one or more values in a given string or series (array, set, or map), returning those containing at least one of the indicated values.
Create column	Creates a Boolean column that shows true when at least one of the indicated values is present in a given string or series (array, set, or map).

Case sensitive

This operation is case sensitive. Use the Contains - case insensitive (weakhas) operation if you need to apply this operation ignoring case.

Complex types

This operation works differently with complex data types.

array/set: only finds complete values.
- Example → ["hello", "goodbye"] → only hello and goodbye would be found, but not he or good.
map: only finds complete values in a key.
tuple: not supported.

How does it work in the search window?

Select Filter / Create field in the search window toolbar, then select the Contains operation. This operation requires at least two arguments (Value and contains). Optionally, you can add as many or also arguments as you need:

Argument	Data type

Argument	Data type
Value ^mandatory	string, array, set, map
contains ^mandatory	string
or also	string

If you use the Create field operation, the data type of the values in the new field is boolean (true or false).

You can also use the Is in (`in`, <-) operation to check for the presence of values in a given string, the only difference is the order of the arguments. The Is in operation requires you to first indicate the value(s) to check and then the general string (value IS IN string), and the Contains operation works the other way around (string CONTAINS value).

Example

In the siem.logtrust.web.activity table, we want to get only the events where the srcHost contains 36, 37, or both. To do it, we will apply a Filter using the Contains (has) operation.

The arguments needed for the filter are:

Value - SrcHost field
contains - Click the pencil icon and enter 36
or also - Click the pencil icon and enter 37

Click Filter data and you will see the following result:

Click Create field and follow the same steps to add a new Boolean field that shows true when the values in the srcHost field contain 36, 37, (or both).

How does it work in LINQ?

Use the operator where... to apply the Filter operation and select... as... to apply the Create column operation. These are the valid formats of the Contains operation:

string_general -> string_value - Note that this format does not admit more than two arguments. Use the below format if you need to add several arguments.
has(string_general, string_value1, string_value2...)

Examples

You can copy the following LINQ script and try the above example on the demo.ecommerce.data table:

from demo.ecommerce.data
  where has(timestamp, "24", "25")

And this is the same example using the Create field operation:

from demo.ecommerce.data
  select has(timestamp, "24", "25") as has_24_or_25

You can also apply this operation using the -> operator. However, this syntax does not admit more than two arguments, so you can only add a single value to be searched in the selected string field. In the following examples, we want to detect events containing 24 in the timestamp field:

from demo.ecommerce.data
  where timestamp -> "24"