=~
The =~ (equals) operator applies a case-insensitive string filter and returns events that match.
The following table provides a comparison of the equal operators:
| Operator | Description | Case-Sensitive | Example (yields true) |
|---|---|---|---|
== | Equal | Yes | "aBc" == "aBc" |
!= | Not equal | Yes | "abc" != "ABC" |
=~ | Equal | No | "abc" =~ "ABC" |
!~ | Not equal | No | "aBc" !~ "xyz" |
When comparing values of different types, Cribl Search performs automatic type conversion wherever possible, giving priority to number comparisons.
For more details on comparison rules, see:
Syntax
Scope | where Field =~ (Expression, ... )
Arguments
- Scope: The input tabular result set to filter.
- Field: The field to filter.
- Expression: An expression used to filter.
Example
dataset=myDataset
| where state =~ "Kansas"
| project EventId, State