Forum Discussion

CodnChips's avatar
CodnChips
Brass Contributor
Mar 15, 2023

Specifying a blank\no value

This is harder than I anticipated.

I want to query all emails sent inbound where no subject was specified.  Can't get the blank bit to work:

 i.e.

EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com" and Subject (This is where I'm stuck - tried iterations of IsEmpty, IsNull but the penny isn't dropping!)
//| project SenderMailFromAddress, Subject
| limit 1000

Thanks for your time

  • Updates: as part of the original reply was missed!


    EmailEvents
    | where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
    | project EmailDirection, SenderMailFromAddress, Subject
    | where isnotempty( Subject)

     

    and what you need (I hope):

    EmailEvents
    | where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
    | project EmailDirection, SenderMailFromAddress, Subject
    | where isempty(Subject)

     
    Tested with:

    EmailEvents
    | where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
    | project EmailDirection, SenderMailFromAddress, Subject
    | summarize empty_=countif(isempty(Subject)), notempty_=countif( isnotempty(Subject)) by SenderMailFromAddress, Subject

  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor

    Updates: as part of the original reply was missed!


    EmailEvents
    | where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
    | project EmailDirection, SenderMailFromAddress, Subject
    | where isnotempty( Subject)

     

    and what you need (I hope):

    EmailEvents
    | where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
    | project EmailDirection, SenderMailFromAddress, Subject
    | where isempty(Subject)

     
    Tested with:

    EmailEvents
    | where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
    | project EmailDirection, SenderMailFromAddress, Subject
    | summarize empty_=countif(isempty(Subject)), notempty_=countif( isnotempty(Subject)) by SenderMailFromAddress, Subject

Resources