Forum Discussion
What does @ mean in KQL?
In page: https://learn.microsoft.com/en-us/training/modules/work-with-data-kusto-query-language/4-integrate-external-data and https://learn.microsoft.com/en-us/training/modules/work-with-data-kusto-query-language/2-extract-data-from-unstructured-string-fields
What does @ mean in below two KQL:
Users | where UserID in ((externaldata (UserID:string) [ @"https://storageaccount.blob.core.windows.net/storagecontainer/users.txt" h@"?...SAS..." // Secret token needed to access the blob ])) | ...
SecurityEvent | where EventID == 4672 and AccountType == 'User' | extend Account_Name = extract(@"^(.*\\)?([^@]*)(@.*)?$", 2, tolower(Account))
Hello KevinLin,
@ here is a part of regex and not KQL.
"You can use '@' prefix to a string literal (similar to .NET)."
Please, check the following:
The string data type - Azure Data Explorer | Microsoft Learn
azure data explorer - KQL Regex Extraction - Stack Overflow
And this: C# Strings (tutorialsteacher.com)
Basically, @ is used to simplify the query.
2 Replies
Hello KevinLin,
@ here is a part of regex and not KQL.
"You can use '@' prefix to a string literal (similar to .NET)."
Please, check the following:
The string data type - Azure Data Explorer | Microsoft Learn
azure data explorer - KQL Regex Extraction - Stack Overflow
And this: C# Strings (tutorialsteacher.com)
Basically, @ is used to simplify the query.
- Thank for reply
