Forum Discussion
Kusto Regex Matches
I'm trying write a query that will match logs where a field contains any domain other than our own. This is what I have tried: | where Recipient matches regex @"(@(?!ourdomain)[A-Za-z0-9]+(.))"...
andrew_bryant I ran into the same issue. I wasn't able to find an answer to do this regex. What I ended up doing was using something like 'where Data.ObjectName !contains ("System Volume Information")' to filter out strings I didn't to be included.
Not sure if this will work in your scenario but this was the only solution I was able to come up with to address this.
mperrotta Thanks. I had thought of that. But this field could contain multiple domains in it. I want to match on any record where the field contains a domain other than ours, even if it also contains ours.