Forum Discussion
Specifying a blank\no value
This is harder than I anticipated.
I want to query all emails sent inbound where no subject was specified. Can't get the blank bit to work:
i.e.
EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com" and Subject (This is where I'm stuck - tried iterations of IsEmpty, IsNull but the penny isn't dropping!)
//| project SenderMailFromAddress, Subject
| limit 1000
Thanks for your time
Updates: as part of the original reply was missed!
EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| where isnotempty( Subject)and what you need (I hope):
EmailEvents | where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com" | project EmailDirection, SenderMailFromAddress, Subject | where isempty(Subject)
Tested with:
EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| summarize empty_=countif(isempty(Subject)), notempty_=countif( isnotempty(Subject)) by SenderMailFromAddress, Subject
- Clive_WatsonBronze Contributor
Updates: as part of the original reply was missed!
EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| where isnotempty( Subject)and what you need (I hope):
EmailEvents | where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com" | project EmailDirection, SenderMailFromAddress, Subject | where isempty(Subject)
Tested with:
EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| summarize empty_=countif(isempty(Subject)), notempty_=countif( isnotempty(Subject)) by SenderMailFromAddress, Subject- CodnChipsBrass ContributorThanks Clive - always very helpful.