Forum Discussion
query multiple "contains"
Sorry for being slow on the uptake, string is the search criteria (or pattern match you want) within the computer name column? e.g.
Heartbeat | extend CompBucket = case(Computer contains "aks", Computer, Computer contains "Con", Computer ,"") | where isnotempty(CompBucket)or
Heartbeat | where Computer contains "aks" or Computer contains "Con" | project Computer
CliveWatson
Returns zero results because the "in~" string operator means 'Equals to one of the elements' (according to https://docs.microsoft.com/en-us/azure/kusto/query/datatypes-string-operators).
I do not need "equals"... I need "contains". I am not looking for full names--only partials. And again, about 12 different strings I want to search. If I could simply provide a list of strings to search, and then have the query look at each of those strings and find matches in the Computer column, that's all I need.
Sorry for being slow on the uptake, string is the search criteria (or pattern match you want) within the computer name column? e.g.
Heartbeat
| extend CompBucket = case(Computer contains "aks", Computer,
Computer contains "Con", Computer
,"")
| where isnotempty(CompBucket)
or
Heartbeat
| where Computer contains "aks"
or Computer contains "Con"
| project Computer- Gotcha... it's all a little onerous, but I guess it's what I've got. It'd be nice to send an array instead of "or" or "case" statements. I'll add that as an enhancement.
Thanks again Clive!ScottAllison I come across the same problem. Can you please share the solution based on array?
