Hello,
I'm trying to create an eval statement that evaluates if a string exists OR another string exists. For example, I'd like to say:
if "\cmd.exe" or "\test.exe /switch" then 1 else 0
So I have the following "attempt":
| eval exe_count=if(match(lower(CommandLine),"\cmd.exe" OR "\\\test.exe \\/switch"),1,0)
But it doesn't seem to work.. so I'm wondering what I'm doing wrong..
Thanks in advance.
Perhaps it was left out from the question, but the first comparator needs to be escaped. Also, the match
command expects a single string for its second argument. Try this.
... | eval exe_count=case(match(lower(CommandLine),"\\\cmd.exe"),1, match(lower(CommandLine),"\\\test.exe \/switch"),1, 1=1,0)
Perhaps it was left out from the question, but the first comparator needs to be escaped. Also, the match
command expects a single string for its second argument. Try this.
... | eval exe_count=case(match(lower(CommandLine),"\\\cmd.exe"),1, match(lower(CommandLine),"\\\test.exe \/switch"),1, 1=1,0)
The force is strong with you.. thank you so much for your help, that's exactly what I was looking for.