Search Query Placeholder/Wildcard for Exact Amount of Characters?

Markus Nebel

June 10, 2022 09:00

Is there a way to replace a certain number of characters with a wildcard in a search query? The asterisk (*) is unfortunately too unspecific for my purposes.

In other query languages there is for example the "?" for a character, or in regex the ".{n}" quantifier, where "n" is the number of characters.

A typical application would be the detection of a base64 encoded single char variable assignment like this:

thus having a search query like this would be very helpful:

script_text=”*JAB?AD0A*”

1 comment

Date Votes

Nils Krumrey June 10, 2022 10:41

Hi Markus,

The search doesn’t use Regex, but at least both * and ? should work ( https://docs.logpoint.com/docs/search-query-language/en/latest/Search%20Query%20Language/Simple%20Search.html#wildcards ). So the query string you mention, *JAB?AD0A* should work perfectly fine. Unless there is some other issue going on with special characters etc.?

For more complicated stuff there’s my old friend, the eval process plugin. It’s match comparison function should be able to do anything you like with Regular Expressions - it’s not the easiest to use but powerful. See https://docs.logpoint.com/docs/evaluation-process-plugin/en/latest/Conditional%20and%20Comparison%20functions.html#match for an example.

Please sign in to leave a comment.