IBM Support

QRadar: Ariel 'contains' filter is a case-insensitive match and therefore may be less efficient than "matches"

How To


Summary

When an Ariel search is run with the "contains" option, it conducts a case-insensitive match. This option means that "contains" is designed to test the text of a specified property without regard to the letter case. As a result, this operation can be more computationally expensive compared to an equivalent "matches" filter.

The "matches" filter, by default, performs case-sensitive pattern matching. This pattern matching will only match text that exactly corresponds to the specified pattern, distinguishing between uppercase and lowercase letters. However, to perform a case-insensitive match with the "matches" filter, you must add the (?i) flag at the beginning of the pattern. This flag tells the filter to ignore case distinctions.


This filter issue happens due to case sensitivity of the AQL.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSV4BL","label":"IBM QRadar"},"ARM Category":[{"code":"a8m0z000000cwtiAAA","label":"Performance"}],"ARM Case Number":"TS012332341","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Product":{"code":"SSTZMA","label":"QRadar Appliance Hardware"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Component":" ","Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB77","label":"Automation Platform"}}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
25 July 2024

UID

ibm17160974

Page Feedback