SOLVED

What does @ mean in KQL?

Copper Contributor

In page: Integrate external data - Training | Microsoft Learn and Extract data from unstructured string fields - Training | Microsoft Learn

 

What does @ mean in below two KQL:
Users |
where UserID in ((externaldata (UserID:string) [ @"https://storageaccount.blob.core.windows.net/storagecontainer/users.txt" h@"?...SAS..." // Secret token needed to access the blob ])) | ...

 

SecurityEvent | where EventID == 4672 and AccountType == 'User' | extend Account_Name = extract(@"^(.*\\)?([^@]*)(@.*)?$", 2, tolower(Account))

2 Replies
best response confirmed by KevinLin (Copper Contributor)
Solution

Hello @KevinLin,

 

@ here is a part of regex and not KQL.

 

"You can use '@' prefix to a string literal (similar to .NET)."

Please, check the following:

The string data type - Azure Data Explorer | Microsoft Learn

azure data explorer - KQL Regex Extraction - Stack Overflow

And this: C# Strings (tutorialsteacher.com)

Basically, @ is used to simplify the query. 

Thank for reply
1 best response

Accepted Solutions
best response confirmed by KevinLin (Copper Contributor)
Solution

Hello @KevinLin,

 

@ here is a part of regex and not KQL.

 

"You can use '@' prefix to a string literal (similar to .NET)."

Please, check the following:

The string data type - Azure Data Explorer | Microsoft Learn

azure data explorer - KQL Regex Extraction - Stack Overflow

And this: C# Strings (tutorialsteacher.com)

Basically, @ is used to simplify the query. 

View solution in original post