https://live.paloaltonetworks.com/t5/strata-logging-service/cortex-data-lake-looking-for-a-sting-of-data-in-the-description/m-p/572762#M5 <P>I am trying to do a search in CDL which will show me when a user disables their Global Protect agent on their end point.&nbsp; I am able to perform this search in Panorama using the search "(opaque contains 'Agent Disable')" under GlobalProtect logs.&nbsp; I am not able to replicate this in CDL</P> <P>&nbsp;</P> <P>I can see the log in CDL looking in Firewall/GlobalProtect logs but I am unable to find a way to search for the string "Agent Disable" in the Description field.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="John_J_0-1704997750305.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56441i57A8DC06F50C5C94/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="John_J_0-1704997750305.png" alt="John_J_0-1704997750305.png" /></span></P> <P>Does anyone know how to search for a specific string in CDL?</P> <P>&nbsp;</P> <P>Thanks!</P> Thu, 18 Apr 2024 18:33:30 GMT John_J 2024-04-18T18:33:30Z https://live.paloaltonetworks.com/t5/strata-logging-service/cortex-data-lake-looking-for-a-sting-of-data-in-the-description/m-p/572762#M5 <P>I am trying to do a search in CDL which will show me when a user disables their Global Protect agent on their end point.&nbsp; I am able to perform this search in Panorama using the search "(opaque contains 'Agent Disable')" under GlobalProtect logs.&nbsp; I am not able to replicate this in CDL</P> <P>&nbsp;</P> <P>I can see the log in CDL looking in Firewall/GlobalProtect logs but I am unable to find a way to search for the string "Agent Disable" in the Description field.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="John_J_0-1704997750305.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56441i57A8DC06F50C5C94/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="John_J_0-1704997750305.png" alt="John_J_0-1704997750305.png" /></span></P> <P>Does anyone know how to search for a specific string in CDL?</P> <P>&nbsp;</P> <P>Thanks!</P> Thu, 18 Apr 2024 18:33:30 GMT https://live.paloaltonetworks.com/t5/strata-logging-service/cortex-data-lake-looking-for-a-sting-of-data-in-the-description/m-p/572762#M5 John_J 2024-04-18T18:33:30Z https://live.paloaltonetworks.com/t5/strata-logging-service/cortex-data-lake-looking-for-a-sting-of-data-in-the-description/m-p/572775#M6 <P>Figured it out:<BR /><BR />Description LIKE "%Agent Disable%"</P> <P>&nbsp;</P> <P>Need a % at both the start and the end of the string you are searching for.</P> Thu, 11 Jan 2024 22:24:48 GMT https://live.paloaltonetworks.com/t5/strata-logging-service/cortex-data-lake-looking-for-a-sting-of-data-in-the-description/m-p/572775#M6 John_J 2024-01-11T22:24:48Z