Forum Discussion
Solved
Wildcard filtering using a watchlist
Hey all, I'm trying to do something like the below: Table
| where Dest !endswith ((_GetWatchlist('watchlist') | project Dest)) However I get an error saying that "StringNotEndsWith operato...
ChristopherKerry Try surrounding the entire expression with not() as in
Heartbeat | where not(ComputerIP has_any("192.168.1.1"))
ChristopherKerry Try surrounding the entire expression with not() as in
Heartbeat
| where not(ComputerIP has_any("192.168.1.1"))
That worked! Thanks Gary
For anyone trying to do the same thing - the resulting query looked like this:
Table
| where not(Dest has_any ((_GetWatchlist('watchlist') | project Dest)))