Forum Discussion
i am trying to fetch the machine list which does not contain letter " l " in 8th position.
I am trying to fetch the machine list which does not contain letter " l " in 8th position. can i use Kusto regex to achieve this. I only see matches regex command.
Can you post the complete query? We will be able to help.
Have you tried using the "| where not" xxxxxxx feature?
Thanks
I used the not operator and it worked.
Meanwhile below is the query
SecurityRecommendation
| where RecommendationName == "Disk encryption should be applied on virtual machines"
| where RecommendationState in ("NotApplicable", "Unhealthy")
| extend field = split(AssessedResourceId, '/')
| extend VM = tostring(field[8])
| extend resourceGroups = tostring(field[4])
| extend subscriptions = tostring(field[2])
| where not(VM matches regex "^.......[l].*") == true
| project VM, RecommendationDisplayName, resourceGroups, subscriptions, TimeGenerated
| extend HostCustomEntity = VM
I used the not operator and it worked.
Meanwhile below is the query
SecurityRecommendation
| where RecommendationName == "Disk encryption should be applied on virtual machines"
| where RecommendationState in ("NotApplicable", "Unhealthy")
| extend field = split(AssessedResourceId, '/')
| extend VM = tostring(field[8])
| extend resourceGroups = tostring(field[4])
| extend subscriptions = tostring(field[2])
| where not(VM matches regex "^.......[l].*") == true
| project VM, RecommendationDisplayName, resourceGroups, subscriptions, TimeGenerated
| extend HostCustomEntity = VM
deepak198486 You can also try just plain indexof() to see if it is faster than using the regex.
| indexof(VM,"l",8,1)==-1
- Hi
I tried using indexof(VM,"l",8,1)==-1 but it is not giving the expected result.
I even tried with indexof_regex() but it also not giving the expected result.- Sorry, forgot the indexof starts its indexed with zero so it would would indexOf(VM,"l",7,1) but in my testing it doesn't seem to be faster.
