Forum Discussion
Solved
What does @ mean in KQL?
In page: Integrate external data - Training | Microsoft Learn and Extract data from unstructured string fields - Training | Microsoft Learn
What does @ mean in below two KQL:
Users | where UserID in ((externaldata (UserID:string) [ @"https://storageaccount.blob.core.windows.net/storagecontainer/users.txt" h@"?...SAS..." // Secret token needed to access the blob ])) | ...
SecurityEvent | where EventID == 4672 and AccountType == 'User' | extend Account_Name = extract(@"^(.*\\)?([^@]*)(@.*)?$", 2, tolower(Account))
Hello KevinLin,
@ here is a part of regex and not KQL.
"You can use '@' prefix to a string literal (similar to .NET)."
Please, check the following:
The string data type - Azure Data Explorer | Microsoft Learn
azure data explorer - KQL Regex Extraction - Stack Overflow
And this: C# Strings (tutorialsteacher.com)
Basically, @ is used to simplify the query.
Hello KevinLin,
@ here is a part of regex and not KQL.
"You can use '@' prefix to a string literal (similar to .NET)."
Please, check the following:
The string data type - Azure Data Explorer | Microsoft Learn
azure data explorer - KQL Regex Extraction - Stack Overflow
And this: C# Strings (tutorialsteacher.com)
Basically, @ is used to simplify the query.
- Thank for reply
