==
The == (equals) operator applies a case-sensitive string, or regex literal, filter and returns events that match.
The following table provides a comparison of the equal operators:
| Operator | Description | Case-Sensitive | Example (yields true) |
|---|---|---|---|
== | Equal | Yes | "aBc" == "aBc" |
!= | Not equal | Yes | "abc" != "ABC" |
=~ | Equal | No | "abc" =~ "ABC" |
!~ | Not equal | No | "aBc" !~ "xyz" |
When comparing values of different types, Cribl Search performs automatic type conversion wherever possible, giving priority to number comparisons.
For more details on comparison rules, see:
Syntax
Scope | where Field == (Expression, ... )
Arguments
Scope: The input tabular result set to filter.
Field: The field to filter.
Expression: An expression used to filter.
To pass regex literals as Expression arguments, see syntax details at Regex Examples, Regex Flags, and Disambiguate Regex Characters.
Example
dataset=myDataset
| where state == "Kansas"
| count