Skip to content

Commit 1a9b308

Browse files
Albertyang0Albertyang0
committed
Updates
1 parent 91414b8 commit 1a9b308

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

‎articles/sentinel/migration-splunk-detection-rules.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -250,16 +250,16 @@ series_decompose_anomalies(Trend)
250250
|`cos(X)` |Calculates the cosine of X. |`n=cos(0)` |[cos()](/kusto/query/cos-function?view=microsoft-sentinel&preserve-view=true) |`cos(X)` |
251251
|`exact(X)` |Evaluates an expression X using double precision floating point arithmetic. |`exact(3.14*num)` |[`todecimal()`](/kusto/query/todecimal-function?view=microsoft-sentinel&preserve-view=true) |`todecimal(3.14*2)` |
252252
|`exp(X)` |Returns eX. |`exp(3)` |[exp()](/kusto/query/exp-function?view=microsoft-sentinel&preserve-view=true) |`exp(3)` |
253-
|`if(X,Y,Z)` |If `X` evaluates to `TRUE`, the result is the second argument `Y`. If `X` evaluates to `FALSE`, the result evaluates to the third argument `Z`. |`if(error==200,`<br> `"OK", "Error")` |[`iff()`](/kusto/query/iff-function?view=microsoft-sentinelc&preserve-view=true) |[KQL example](#ifxyz-kql-example) |
254-
|`isbool(X)` |Returns `TRUE` if `X` is boolean. |`isbool(field)` |• [`iff()`](/kusto/query/iff-function?view=microsoft-sentinelc&preserve-view=true)<br>• [`gettype`](/kusto/query/gettype-function?view=microsoft-sentinel&preserve-view=true) |`iff(gettype(X) =="bool","TRUE","FALSE")` |
255-
|`isint(X)` |Returns `TRUE` if `X` is an integer. |`isint(field)` |• [`iff()`](/kusto/query/iff-function?view=microsoft-sentinelc&preserve-view=true)<br>• [`gettype`](/kusto/query/gettype-function?view=microsoft-sentinel&preserve-view=true) |[KQL example](#isintx-kql-example) |
253+
|`if(X,Y,Z)` |If `X` evaluates to `TRUE`, the result is the second argument `Y`. If `X` evaluates to `FALSE`, the result evaluates to the third argument `Z`. |`if(error==200,`<br> `"OK", "Error")` |[`iff()`](/kusto/query/iff-function?view=microsoft-sentinel&preserve-view=true) |[KQL example](#ifxyz-kql-example) |
254+
|`isbool(X)` |Returns `TRUE` if `X` is boolean. |`isbool(field)` |• [`iff()`](/kusto/query/iff-function?view=microsoft-sentinel&preserve-view=true)<br>• [`gettype`](/kusto/query/gettype-function?view=microsoft-sentinel&preserve-view=true) |`iff(gettype(X) =="bool","TRUE","FALSE")` |
255+
|`isint(X)` |Returns `TRUE` if `X` is an integer. |`isint(field)` |• [`iff()`](/kusto/query/iff-function?view=microsoft-sentinel&preserve-view=true)<br>• [`gettype`](/kusto/query/gettype-function?view=microsoft-sentinel&preserve-view=true) |[KQL example](#isintx-kql-example) |
256256
|`isnull(X)` |Returns `TRUE` if `X` is null. |`isnull(field)` |[`isnull()`](/kusto/query/isnull-function?view=microsoft-sentinel&preserve-view=true) |`isnull(field)` |
257-
|`isstr(X)` |Returns `TRUE` if `X` is a string. |`isstr(field)` |• [`iff()`](/kusto/query/iff-function?view=microsoft-sentinelc&preserve-view=true)<br>• [`gettype`](/kusto/query/gettype-function?view=microsoft-sentinel&preserve-view=true) |[KQL example](#isstrx-kql-example) |
257+
|`isstr(X)` |Returns `TRUE` if `X` is a string. |`isstr(field)` |• [`iff()`](/kusto/query/iff-function?view=microsoft-sentinel&preserve-view=true)<br>• [`gettype`](/kusto/query/gettype-function?view=microsoft-sentinel&preserve-view=true) |[KQL example](#isstrx-kql-example) |
258258
|`len(X)` |This function returns the character length of a string `X`. |`len(field)` |[`strlen()`](/kusto/query/strlen-function?view=microsoft-sentinel&preserve-view=true) |`strlen(field)` |
259259
|`like(X,"y")` |Returns `TRUE` if and only if `X` is like the SQLite pattern in `Y`. |`like(field, "addr%")` |• [`has`](/kusto/query/has-any-operator?view=microsoft-sentinel&preserve-view=true)<br>• [`contains`](/kusto/query/datatypes-string-operators?view=microsoft-sentinel&preserve-view=true)<br>• [`startswith`](/kusto/query/datatypes-string-operators?view=microsoft-sentinel&preserve-view=true)<br>• [matches regex](/kusto/query/regex?view=microsoft-sentinel&preserve-view=true) |[KQL example](#likexy-example) |
260260
|`log(X,Y)` |Returns the log of the first argument `X` using the second argument `Y` as the base. The default value of `Y` is `10`. |`log(number,2)` |• [`log`](/kusto/query/log-function?view=microsoft-sentinel&preserve-view=true)<br>• [`log2`](/kusto/query/log2-function?view=microsoft-sentinel&preserve-view=true)<br>• [`log10`](/kusto/query/log10-function?view=microsoft-sentinel&preserve-view=true) |`log(X)`<br><br>`log2(X)`<br><br>`log10(X)` |
261261
|`lower(X)` |Returns the lowercase value of `X`. |`lower(username)` |[tolower](/kusto/query/tolower-function?view=microsoft-sentinel&preserve-view=true) |`tolower(username)` |
262-
|`ltrim(X,Y)` |Returns `X` with the characters in parameter `Y` trimmed from the left side. The default output of `Y` is spaces and tabs. |`ltrim(" ZZZabcZZ ", " Z")` |[`trim_start()`](/kusto/query/trim-start-function?view=microsoft-sentinelc&preserve-view=true) |`trim_start(“ ZZZabcZZ”,” ZZZ”)` |
262+
|`ltrim(X,Y)` |Returns `X` with the characters in parameter `Y` trimmed from the left side. The default output of `Y` is spaces and tabs. |`ltrim(" ZZZabcZZ ", " Z")` |[`trim_start()`](/kusto/query/trim-start-function?view=microsoft-sentinel&preserve-view=true) |`trim_start(“ ZZZabcZZ”,” ZZZ”)` |
263263
|`match(X,Y)` |Returns if X matches the regex pattern Y. |`match(field, "^\d{1,3}.\d$")` |[`matches regex`](/kusto/query/regex?view=microsoft-sentinel&preserve-view=true) |`… | where field matches regex @"^\d{1,3}.\d$")` |
264264
|`max(X,…)` |Returns the maximum value in a column. |`max(delay, mydelay)` |• [`max()`](/kusto/query/max-aggregation-function?view=microsoft-sentinel&preserve-view=true)<br>• [`arg_max()`](/kusto/query/arg-max-aggregation-function?view=microsoft-sentinel&preserve-view=true) |`… | summarize max(field)` |
265265
|`md5(X)` |Returns the MD5 hash of a string value `X`. |`md5(field)` |[`hash_md5`](/kusto/query/hash-md5-function?view=microsoft-sentinel&preserve-view=true) |`hash_md5("X")` |
@@ -270,13 +270,13 @@ series_decompose_anomalies(Trend)
270270
|`mvjoin(X,Y)` |Given a multi-valued field `X` and string delimiter `Y`, and joins the individual values of `X` using `Y`. |`mvjoin(address, ";")` |[`strcat_array`](/kusto/query/strcat-array-function?view=microsoft-sentinel&preserve-view=true) |[KQL example](#mvjoinxy-kql-example) |
271271
|`now()` |Returns the current time, represented in Unix time. |`now()` |[`now()`](/kusto/query/now-function?view=microsoft-sentinel&preserve-view=true) |`now()`<br><br>`now(-2d)` |
272272
|`null()` |Doesn't accept arguments and returns `NULL`. |`null()` |[null](/kusto/query/scalar-data-types/null-values) |`null`
273-
|`nullif(X,Y)` |Includes two arguments, `X` and `Y`, and returns `X` if the arguments are different. Otherwise, returns `NULL`. |`nullif(fieldA, fieldB)` |[`iff`](/kusto/query/iff-function?view=microsoft-sentinelc&preserve-view=true) |`iff(fieldA==fieldB, null, fieldA)` |
273+
|`nullif(X,Y)` |Includes two arguments, `X` and `Y`, and returns `X` if the arguments are different. Otherwise, returns `NULL`. |`nullif(fieldA, fieldB)` |[`iff`](/kusto/query/iff-function?view=microsoft-sentinel&preserve-view=true) |`iff(fieldA==fieldB, null, fieldA)` |
274274
|`random()` |Returns a pseudo-random number between `0` to `2147483647`. |`random()` |[`rand()`](/kusto/query/rand-function?view=microsoft-sentinel&preserve-view=true) |`rand()` |
275275
|`relative_ time(X,Y)` |Given an epoch time `X` and relative time specifier `Y`, returns the epoch time value of `Y` applied to `X`. |`relative_time(now(),"-1d@d")` |[unix time](/kusto/query/datetime-timespan-arithmetic?view=microsoft-sentinel&preserve-view=true#example-unix-time) |[KQL example](#relative-timexy-kql-example) |
276-
|`replace(X,Y,Z)` |Returns a string formed by substituting string `Z` for every occurrence of regular expression string `Y` in string `X`. |Returns date with the month and day numbers switched.<br>For example, for the `4/30/2015` input, the output is `30/4/2009`:<br><br>`replace(date, "^(\d{1,2})/ (\d{1,2})/", "\2/\1/")` |[`replace()`](/kusto/query/replace-string-function?view=microsoft-sentinelc&preserve-view=true) |[KQL example](#replacexyz-kql-example) |
276+
|`replace(X,Y,Z)` |Returns a string formed by substituting string `Z` for every occurrence of regular expression string `Y` in string `X`. |Returns date with the month and day numbers switched.<br>For example, for the `4/30/2015` input, the output is `30/4/2009`:<br><br>`replace(date, "^(\d{1,2})/ (\d{1,2})/", "\2/\1/")` |[`replace()`](/kusto/query/replace-string-function?view=microsoft-sentinel&preserve-view=true) |[KQL example](#replacexyz-kql-example) |
277277
|`round(X,Y)` |Returns `X` rounded to the number of decimal places specified by `Y`. The default is to round to an integer. |`round(3.5)` |[`round`](/kusto/query/round-function?view=microsoft-sentinel&preserve-view=true) |`round(3.5)` |
278278
|`rtrim(X,Y)` |Returns `X` with the characters of `Y` trimmed from the right side. If `Y` isn't specified, spaces and tabs are trimmed. |`rtrim(" ZZZZabcZZ ", " Z")` |[`trim_end()`](/kusto/query/trim-end-function?view=microsoft-sentinel&preserve-view=true) |`trim_end(@"[ Z]+",A)` |
279-
|`searchmatch(X)` |Returns `TRUE` if the event matches the search string `X`. |`searchmatch("foo AND bar")` |[iff()](/kusto/query/iff-function?view=microsoft-sentinelc&preserve-view=true) |`iff(field has "X","Yes","No")` |
279+
|`searchmatch(X)` |Returns `TRUE` if the event matches the search string `X`. |`searchmatch("foo AND bar")` |[iff()](/kusto/query/iff-function?view=microsoft-sentinel&preserve-view=true) |`iff(field has "X","Yes","No")` |
280280
| `split(X,"Y")` |Returns `X` as a multi-valued field, split by delimiter `Y`. |`split(address, ";")` |[`split()`](/kusto/query/split-function?view=microsoft-sentinel&preserve-view=true) |`split(address, ";")` |
281281
|`sqrt(X)` |Returns the square root of `X`. |`sqrt(9)` |[`sqrt()`](/kusto/query/sqrt-function?view=microsoft-sentinel&preserve-view=true) |`sqrt(9)` |
282282
|`strftime(X,Y)` |Returns the epoch time value `X` rendered using the format specified by `Y`. |`strftime(_time, "%H:%M")` |[`format_datetime()`](/kusto/query/format-datetime-function?view=microsoft-sentinel&preserve-view=true) |`format_datetime(time,'HH:mm')` |

0 commit comments

Comments
 (0)