Wildcard filtering using a watchlist

[ChristopherKerry]

Hey all,

I'm trying to do something like the below:

Table
| where Dest !endswith ((_GetWatchlist('watchlist') | project Dest))

However I get an error saying that "StringNotEndsWith operator requires string arguments" 

Any idea how to search a watchlist like this?? Many thanks in advance.

[#2]

@ChristopherKerry !endswith is looking for a string value and you are passing in a table (which is what the _GetWatchlist returns)

Not sure how you would actually be able to do what you are attempting.  Does your watchlist only have a single row?

[#3]

Thanks Gary,

No it's got multiple rows. I had a look at has_any which seems similar to a contains but over multiple rows, but unfortunately there's not a version of !has_any .

[#4 · Accepted solution]

@ChristopherKerry Try surrounding the entire expression with not() as in 

Heartbeat
| where not(ComputerIP has_any("192.168.1.1"))

[#5]

@Gary Bushey 

That worked! Thanks Gary

For anyone trying to do the same thing - the resulting query looked like this:

Table
| where not(Dest has_any ((_GetWatchlist('watchlist') | project Dest)))