Forum Discussion
KQL | where User !in (AuditSearch)
Hi, I'm searching through AuditLogs to check for a previous event and using the let statement to assign to a temporary table called AuditSearch. Another search of the AuditLog is being done w...
Hi,
Decided to use a table join with rightanti which shows the results whereby second search doesn't appear in first search and also works if first search doesn't find any results (which the !in didnt work for that scenario)
Decided to use a table join with rightanti which shows the results whereby second search doesn't appear in first search and also works if first search doesn't find any results (which the !in didnt work for that scenario)