if match eval with an or

[jclemons7]

Hello,

I'm trying to create an eval statement that evaluates if a string exists OR another string exists. For example, I'd like to say:

if "\cmd.exe" or "\test.exe /switch" then 1 else 0

So I have the following "attempt":

| eval exe_count=if(match(lower(CommandLine),"\cmd.exe" OR "\\\test.exe \\/switch"),1,0)

But it doesn't seem to work.. so I'm wondering what I'm doing wrong..

Thanks in advance.

[richgalloway · Accepted solution]

Perhaps it was left out from the question, but the first comparator needs to be escaped. Also, the match command expects a single string for its second argument. Try this.

... | eval exe_count=case(match(lower(CommandLine),"\\\cmd.exe"),1, match(lower(CommandLine),"\\\test.exe \/switch"),1, 1=1,0)

[jclemons7]

The force is strong with you.. thank you so much for your help, that's exactly what I was looking for.