Forum Discussion

ZachYun's avatar
ZachYun
Copper Contributor
Jun 23, 2021

How to apply string literal @ to all items in a watchlist

We're currently using a file path watchlist (csv file where each item is a path name, ex C:\sys\svchost), and the match using !in~ against the watchlist is failing. If we take a single item from the ...
Rod_Trent's avatar
Rod_Trent
Icon for Microsoft rankMicrosoft
Jun 23, 2021
Have you tried the literal backslash? i.e.,...

C:\\sys\\svchost
ZachYun's avatar
ZachYun
Copper Contributor
Jun 23, 2021
I'm sure that would work, but since we're uploading a large watchlist file (thousands of rows with dynamic paths), I'm looking for a method to do a literal comparison on the GUI instead of trying to modify each row with escape characters.
  • Rod_Trent's avatar
    Rod_Trent
    Icon for Microsoft rankMicrosoft
    Jun 23, 2021
    So, maybe I'm missing something, but you just need to use literal backslashes in your KQL query. Keep it single slash in the Watchlist.