Split Microsoft Sentinel Tables with Multi-Destination Data Collection Rules

Ciyaresh91 

It is possible, but these streams are not chained. So instead of creating one with a 'Drop' destination you can just tell not to include that data set in your table, like this:
So everything else will be forwarded but the data you want to filter out.

    { 
          "streams": [ 
            "Microsoft-Microsoft-WindowsEvent" 
          ], 
          "destinations": [ 
            "myworkspace" 
          ], 
          "transformKql": "source | where not (EventData has 'string that we would like to exclude)'
          "outputStream": "Microsoft-Microsoft-WindowsEvent" 
    }