Forum Discussion
KQL query: except where condition1, condition2, and condition3 all evaluate true
Hi Sentinel friends, I've googled and read through many guides and can't find an easy way to perform a multi-variable exclusion statement. I need to be able to exclude a result if multiple variab...
Hi browesec,
I believe the function you are looking for is https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/not-function.
In your example:
Table
| where Event == "12"
| where not(condition1 == x AND condition2 == y AND condition 3 == z)
If all three conditions evaluate to true, the row is not included in the results. If any of the three conditions evaluates to false, the row will be included in the results.
Please let me know if you have any follow-up questions. I hope this helps and wish you a great day!
Kind regards,
Rutger