CB Response: How to prevent searches on empty fields in a query
search cancel

CB Response: How to prevent searches on empty fields in a query

book

Article ID: 289547

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Query on a specific field only if there is a value in the field 

Environment

  • CB Response Server: 6.0 and Above

Resolution

  • Use the wildcard operator (*) with the field name to return results which only contain a value in that field.
    • field_name:*

       

Additional Information

  • This can be used to improv query performance even when querying for specific values in a field.
    • domain:* AND -domain:carbonblack.com