This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies. For details on cookie usage on our site, read our Privacy Policy
When carrying out XQL search...."dataset = xdr_data | fields action_country | dedup action_country" I receive a set of results with different action_country values as expected. If I then take one of these values ie Switzerland and run "dataset = xdr_data | fields action_country | filter action_country = SWITZERLAND" I receive expected results. If i run the same search with "dataset = xdr_data | fields action_country | filter action_country = IRAN,_ISLAMIC_REPUBLIC_OF " it will not allow me to run the search, as if the search rule is not complete. Surrounding IRAN_,ISLAMIC REPUBLIC OF in quotes allows me to carry out the search however then returns no results despite results being returned in the first search
... View more