CB Response: How to prevent searches on empty fields in a query
book
Article ID: 289547
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- Query on a specific field only if there is a value in the field
Environment
- CB Response Server: 6.0 and Above
Resolution
- Use the wildcard operator (*) with the field name to return results which only contain a value in that field.
Additional Information
- This can be used to improv query performance even when querying for specific values in a field.
Feedback
thumb_up
Yes
thumb_down
No