I'm trying to create an eval statement that evaluates if a string exists OR another string exists. For example, I'd like to say:
if "\cmd.exe" or "\test.exe /switch" then 1 else 0
So I have the following "attempt":
| eval exe_count=if(match(lower(CommandLine),"\cmd.exe" OR "\\\test.exe \\/switch"),1,0)
But it doesn't seem to work.. so I'm wondering what I'm doing wrong..
Thanks in advance.
Perhaps it was left out from the question, but the first comparator needs to be escaped. Also, the match command expects a single string for its second argument. Try this.
... | eval exe_count=case(match(lower(CommandLine),"\\\cmd.exe"),1, match(lower(CommandLine),"\\\test.exe \/switch"),1, 1=1,0)
View solution in original post
The force is strong with you.. thank you so much for your help, that's exactly what I was looking for.