Any name matches (anymatches)
You can apply this operation either as a Filter or Create column operation:
Filters a field containing sets of names in set(name) format and shows only those values that match one or more of the specified patterns (in namepattern format).
Creates a new Boolean column that shows true when the values in a set(name) field match one or more of the specified patterns (in namepattern format).
You can find a field containing sets of table names in set(name) format in the
all.data table, which contains information about all the tables in your domain. You can also access this table after performing a global search.
About name patterns
Name patterns use asterisks as wildcards to allow you to identify any table whose name matches a pattern. The accepted syntax for glob patterns in Devo include:
siem.*.*.*- table names with four levels where the first is
siem.**- table names with any number of levels where the first is
**.all.**- table names containing
allas a name level at any level in the name
**.*ss*.**- table names containing "ss" within a name level at any level in the name
You can see that a single asterisk is a wildcard for part of or a whole level of a table name, while two asterisks represent any number of levels. You must include "." in the name pattern to guide the search. You can transform the strings in a field to name patterns in namepattern data type creating a new column using the Glob pattern on names operation.
How does it work in the search window?
Select Filter / Create column in the search window toolbar, then select the Any name matches operation. You need to specify at least two arguments. You can add as many or matches arguments as required.
|Some name of (mandatory)||set(name)|
If you use the Create column operation, the data type of the values in the new column is boolean (true or false).
When you apply this operation in the search window interface, Devo automatically transforms the values you enter manually in the matches argument into namepattern data type.
If you choose a column in the matches argument, it must be a namepattern data type column. Remember that you can transform the strings in a field to namepatterns creating a new column using the Glob pattern on names operation.
all.data table, we want to get only siem tables with four levels in the tables column. We will manually enter the pattern siem.*.*.* to match any table name with siem in its first-level name, and having four levels. To do it, we will apply a Filter using the Any name matches operation.
The arguments needed for the filter are:
- Some name of - tables column
- matches - Click the pencil icon and enter siem.*.*.*
Click Filter data and you will see the following result:
Click Create column and follow the same steps to add a new Boolean column that shows true when the values in the tables column match the siem.*.*.* format.
How does it work in LINQ?
Use the operator
where... to apply the Filter operation and
as... to apply the Create column operation. These are the valid formats of the Any name matches operation:
When you use this operation in LINQ, you must use the Glob pattern on names operation to transform the field or value entered to namepattern format. To do it, add the
nameglob() operator as in the first format example.
You can copy the following LINQ script and try the above example on the
from all.data where anymatches(tables, nameglob("siem.*.*.*"))
And this is the same example using the Create column operation:
from all.data select anymatches(tables, nameglob("siem.*.*.*")) as siem_tables