Forum Discussion

jainshamu's avatar
jainshamu
Copper Contributor
Sep 22, 2021

AND operator in KQL

How can we whitelist combination of columns using KQL. For Eg. I want to create exclusion like below:   | where column1 !contains "abc" and column2 !contains "qwe" and column3 !contains "xyz"   w...
CliveWatson's avatar
CliveWatson
Former Employee
Sep 22, 2021

GaryBushey 

 

I would have expected the original query to work, similar example I use (slightly modified). 

 

Usage
| where tostring(IsBillable) !contains "false" and 
        DataType !in("Operation", "Usage") and
        DataType !startswith "VM" and 
        Solution !contains "Log"
| summarize by DataType, Solution, IsBillable

 

GaryBushey's avatar
GaryBushey
Bronze Contributor
Sep 22, 2021

CliveWatson  Out of curiosity, Is there any benefit to using one way over the other?  Is one faster than the other?

Resources