Forum Discussion
AND operator in KQL
How can we whitelist combination of columns using KQL. For Eg. I want to create exclusion like below: | where column1 !contains "abc" and column2 !contains "qwe" and column3 !contains "xyz" w...
While I could not unravel the mystery around use of !contains & AND operator, I finally managed to do achieve end result with something like
| extend X = column1 contains "abc" and column2 contains "qwe" and column3 contains "xyz"
| where X != true
| extend X = column1 contains "abc" and column2 contains "qwe" and column3 contains "xyz"
| where X != true