I was looking at the KQL for one of the charts in a workbook and came across this statement that I cannot figure out what it does.
View best response
in allows you to to use a list. so where AppDisplayName in ('*') is saying basically where appdisplayname is populated.
@Nicholas DiCola (SECURITY JEDI) So does
"*" in ("*")
A) If any column has data
B) if all columns have data
C) Something entirely different?
since its an or it should be A