Specifying a blank\no value

This is harder than I anticipated. I want to query all emails sent inbound where no subject was specified. Can't get the blank bit to work: i.e. EmailEvents | where EmailDirection == "Inbound" ...

KQL

kusto

Clive_Watson
Mar 15, 2023
Updates: as part of the original reply was missed!

EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| where isnotempty( Subject)

and what you need (I hope):

EmailEvents | where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com" | project EmailDirection, SenderMailFromAddress, Subject | where isempty(Subject)

Tested with:

EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| summarize empty_=countif(isempty(Subject)), notempty_=countif( isnotempty(Subject)) by SenderMailFromAddress, Subject

Clive_Watson

Bronze Contributor

Mar 15, 2023

Updates: as part of the original reply was missed!

EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| where isnotempty( Subject)

and what you need (I hope):

EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| where isempty(Subject)

Tested with:

EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| summarize empty_=countif(isempty(Subject)), notempty_=countif( isnotempty(Subject)) by SenderMailFromAddress, Subject

CodnChips
Brass Contributor
Mar 30, 2023
Thanks Clive - always very helpful.

Forum Discussion

Specifying a blank\no value

Resources