Cortex Data Lake - Looking for a sting of data in the Description field

[John_J]

I am trying to do a search in CDL which will show me when a user disables their Global Protect agent on their end point.  I am able to perform this search in Panorama using the search "(opaque contains 'Agent Disable')" under GlobalProtect logs.  I am not able to replicate this in CDL

I can see the log in CDL looking in Firewall/GlobalProtect logs but I am unable to find a way to search for the string "Agent Disable" in the Description field.

Does anyone know how to search for a specific string in CDL?

Thanks!

[John_J · Accepted solution]

Figured it out:

Description LIKE "%Agent Disable%"

Need a % at both the start and the end of the string you are searching for.