Examples
If '.exe' is present on the
action_process_image_name
field value,
replace that substring with an empty string. This example uses the
replace
and
lowercase
functions, as well as the
contains operator
to perform the conditional check.
dataset = xdr_data
| fields action_process_image_name as apin
| filter apin != null
| alter remove_exe_process =
if(lowercase(apin) contains ".exe", // boolean expression
replace(lowercase(apin),".exe",""), // return if true
lowercase(apin)) // return if false
| limit 10
