replace
Cortex XDR XQL replace function performs a substring replacement.
Synopsis
replace (<field>, "<old_substring>", "<new_string>")
Description
The
replace()
function accepts a string field, and replaces all occurrences
of a substring with a replacement string.
Examples
dataset = xdr_data | fields action_process_image_name as apin | filter apin != null | alter remove_exe_process = if(lowercase(apin) contains ".exe", replace(lowercase(apin),".exe",""), lowercase(apin)) | limit 10
See also the trim
function example.
Recommended For You
Recommended Videos
Recommended videos not found.
