Forum Discussion
How to apply string literal @ to all items in a watchlist
We're currently using a file path watchlist (csv file where each item is a path name, ex C:\sys\svchost), and the match using !in~ against the watchlist is failing. If we take a single item from the ...
I'm sure that would work, but since we're uploading a large watchlist file (thousands of rows with dynamic paths), I'm looking for a method to do a literal comparison on the GUI instead of trying to modify each row with escape characters.
Rod_Trent
Microsoft
MicrosoftSo, maybe I'm missing something, but you just need to use literal backslashes in your KQL query. Keep it single slash in the Watchlist.