SOLVED

Specifying a blank\no value

Brass Contributor

This is harder than I anticipated.

I want to query all emails sent inbound where no subject was specified.  Can't get the blank bit to work:

 i.e.

EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com" and Subject (This is where I'm stuck - tried iterations of IsEmpty, IsNull but the penny isn't dropping!)
//| project SenderMailFromAddress, Subject
| limit 1000

Thanks for your time

2 Replies
best response confirmed by CodnChips (Brass Contributor)
Solution

Updates: as part of the original reply was missed!


EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| where isnotempty( Subject)

 

and what you need (I hope):

EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| where isempty(Subject)

 
Tested with:

EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| summarize empty_=countif(isempty(Subject)), notempty_=countif( isnotempty(Subject)) by SenderMailFromAddress, Subject

Thanks Clive - always very helpful.
1 best response

Accepted Solutions
best response confirmed by CodnChips (Brass Contributor)
Solution

Updates: as part of the original reply was missed!


EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| where isnotempty( Subject)

 

and what you need (I hope):

EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| where isempty(Subject)

 
Tested with:

EmailEvents
| where EmailDirection == "Inbound" and SenderMailFromAddress contains "gmail.com"
| project EmailDirection, SenderMailFromAddress, Subject
| summarize empty_=countif(isempty(Subject)), notempty_=countif( isnotempty(Subject)) by SenderMailFromAddress, Subject

View solution in original post