Forum Discussion
Partial lookup and case using watchlist
Hi, I'm new to KQL and I cannot wrap my head around this. Maybe I have the wrong approach. We have prefixes in our device names which contains the office location of the device. So xxBE*, wou...
LukeI91 Can you extract the prefixes out of the DeviceName using something like
| extract prefix = substring(DeviceName,0,4)and then do a join on that and the data you have in the watchlist? Are all the prefixes the same length?
- Hi Gary,
That is a great suggestion, thank you!
There is only 1 prefix that is 1 character longer but for now I can use your trick twice. Thanks a lot!
