Oct 05 2019 04:05 PM
I was looking at the KQL for one of the charts in a workbook and came across this statement that I cannot figure out what it does.
Oct 08 2019 07:27 AM
Solutionhttps://docs.microsoft.com/en-us/azure/kusto/query/inoperator
in allows you to to use a list. so where AppDisplayName in ('*') is saying basically where appdisplayname is populated.
Oct 08 2019 03:15 PM
@Nicholas DiCola (SECURITY JEDI) So does
"*" in ("*")
Mean
A) If any column has data
B) if all columns have data
C) Something entirely different?
Oct 08 2019 07:27 AM
Solutionhttps://docs.microsoft.com/en-us/azure/kusto/query/inoperator
in allows you to to use a list. so where AppDisplayName in ('*') is saying basically where appdisplayname is populated.