Forum Discussion

ChristopherKerry's avatar
ChristopherKerry
Copper Contributor
Mar 31, 2021

Wildcard filtering using a watchlist

Hey all,   I'm trying to do something like the below: Table | where Dest !endswith ((_GetWatchlist('watchlist') | project Dest))   However I get an error saying that "StringNotEndsWith operato...
  • GaryBushey's avatar
    GaryBushey
    Apr 01, 2021

    ChristopherKerry Try surrounding the entire expression with not() as in 

    Heartbeat
    | where not(ComputerIP has_any("192.168.1.1"))

Resources