Feb 20 2019
11:56 AM
- last edited on
Apr 07 2022
05:41 PM
by
TechCommunityAP
Feb 20 2019
11:56 AM
- last edited on
Apr 07 2022
05:41 PM
by
TechCommunityAP
Hello everyone,
I'm am looking for a few pointers on making a more efficient query. Is there a better way of expressing the pseudo-query below?
OfficeActivity
| where UserId !contains "person@email" or UserId !contains "another@email" or UserId !contains "user@email" or UserId !contains ...
Is there a solution that will allow me to apply only one contains to multiple values instead of writing a contains for each one?
Thank you.
Feb 20 2019 10:44 PM
Hi,
If you use !has it will be more performant than !contains. In case UserId values like person@email are the full values and not partial ones you can do this:
OfficeActivity | where UserId !in~ ("person@email","another@email","user@email")
!in~ should also be more efficient than !contains. Let me know if this answers your question.