Forum Discussion

ZachYun's avatar
ZachYun
Copper Contributor
Jun 23, 2021

How to apply string literal @ to all items in a watchlist

We're currently using a file path watchlist (csv file where each item is a path name, ex C:\sys\svchost), and the match using !in~ against the watchlist is failing. If we take a single item from the ...
Rod_Trent's avatar
Rod_Trent
Icon for Microsoft rankMicrosoft
Jun 23, 2021
Have you tried the literal backslash? i.e.,...

C:\\sys\\svchost
  • ZachYun's avatar
    ZachYun
    Copper Contributor
    Jun 23, 2021
    I'm sure that would work, but since we're uploading a large watchlist file (thousands of rows with dynamic paths), I'm looking for a method to do a literal comparison on the GUI instead of trying to modify each row with escape characters.
    • Rod_Trent's avatar
      Rod_Trent
      Icon for Microsoft rankMicrosoft
      Jun 23, 2021
      So, maybe I'm missing something, but you just need to use literal backslashes in your KQL query. Keep it single slash in the Watchlist.