Digital Developer Conference: a FREE half-day online conference focused on AI & Cloud – North America: Nov 2 – India: Nov 9 – Europe: Nov 14 – Asia Nov 23 Register now

Refine your search by using the following advanced search options.

Criteria	Usage
Questions with keyword1 or keyword2	keyword1 keyword2
Questions with a mandatory word, e.g. keyword2	keyword1 +keyword2
Questions excluding a word, e.g. keyword2	keyword1 -keyword2
Questions with keyword(s) and a specific tag	keyword1 [tag1]
Questions with keyword(s) and either of two or more specific tags	keyword1 [tag1] [tag2]
To search for all posts by a user or all posts with a specific tag, start typing and choose from the suggestion list. Do not use a plus or minus sign with a tag, e.g., +[tag1].

Ask a question

AQL query to search for payload contains filter

Question by PrashantSainju (1) | Jun 06, 2018 at 06:56 PM qradar aql payload queries

Is there a way to search for payload contains with AQL

Example: payload contains is "some value"

Answer by Daniel Zerkle (638) | Jun 06, 2018 at 07:39 PM

Yes. You can use the TEXT SEARCH operator.

Also, "payload" is a standard field in AQL. I seem to recall that there are some restrictions on its use in AQL, but possible operators are LIKE, ILIKE, MATCHES, and IMATCHES.

0 Share

Answer by AlexYakovlev (399) | Jun 07, 2018 at 04:13 AM

Hi,

Try it:

 UTF8(payload) ILIKE '%TEXT%'

0 Show 1 Share

PrashantSainju (1) Jun 08, 2018 at 12:20 PM 0

That worked. Thank you Alex

AQL query to search for payload contains filter

2 answers

Follow this question

AQL query to search for payload contains filter

2 answers

Follow this question

Related questions