Is in - case insensitive (weakin)

[ 1 Description ] [ 2 How does it work in the search window? ] [ 3 How does it work in LINQ? ]

Description

You can apply this operation either as a Filter or Create field operation:

Filter	Returns only those strings that contain a specified value, ignoring case.
Create field	Creates a Boolean field that shows true only for those strings that contain a specified value, ignoring case.

Use the Is in (`in`, <-) operation if you need to discriminate between uppercase and lowercase letters.

How does it work in the search window?

Select Filter / Create field in the search window toolbar, then select the Is in - case insensitive operation. You need to specify two arguments:

Argument	Data type

Argument	Data type
Value ^mandatory	string
is in (ignoring case) ^mandatory	string

If you use the Create field operation, the data type of the values in the new field is boolean (true or false).

You can also use the Contains - case insensitive (weakhas) operation to check for the presence of values in a given string, the only difference is the order of the arguments. The Is in - case insensitive operation requires you to first indicate the value(s) to check and then the general string (value IS IN string), and the Contains - case insensitive operation works the other way around (string CONTAINS value).

Example

In the siem.logtrust.web.activity table, we want to get only the events that contain control in the Headers field. field, ignoring case. To do it, we will apply a Filter using the Is in- case insensitive operation.

Active case insensitive

Some operations have a case sensitive and a case insensitive version, for example, Contains - case insensitive (weakhas) and Contains (has, ->). Use these options to display only the sensitive or insensitive versions of these operations, or choose all to show both versions. Operations that don't have a sensitive and insensitive version will be visible regardless of the option selected. You can select the default option in your User preferences, and Admin users can do the same for all the users in the domain in their Domain preferences.

The arguments needed for the filter are:

Value - Click the pencil icon and enter control or Control. Since this operation is case insensitive, the filter will return the same results with both values.
is in (ignoring case) - uri column

Click Filter data and you will see the following result:

Click Create column and follow the same steps to add a new Boolean column that shows true when the strings in the uri column contain log.

How does it work in LINQ?

Use the operator where... to apply the Filter operation and select... as... to apply the Create column operation. These are the valid formats of the Is in - case insensitive operation:

weakin(string_value, string_general)

Example

You can copy the following LINQ script and try the above example on the demo.ecommerce.data table:

from demo.ecommerce.data
  where weakin("log", uri)

And this is the same example using the Create column operation:

from demo.ecommerce.data
  select weakin("log", uri) as log_isin_uri