Question 399581 in Azure Question posted in
The official documentation to get you started can be found here.

Azure – how to use or condition in kql

Trying to write a KQL query where results should come when the table column Rawdata either contains any of the strings – job1 or job2 :-

 Tablename 
 | where RawData contains "JOB1" OR "JOB2"

The above gives me errror, what is the right way to do it

Tags:

2

Answers


  1. 0

    The right way to do it:

    Tablename 
| where RawData contains "JOB1" or RawData contains "JOB2"

    If "JOB1" and "JOB2" is a term then you can use the operator has_any

    Tablename 
| where RawData has_any ("JOB1", "JOB2")

    https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/datatypes-string-operators#what-is-a-term

    Login or Signup to reply.
  2. 0

    You can also use in() if you want to search through rows.

    table
| where <column_name> in ("<word1>","<word2>");

    In this case, the entire row of the column must match the given word, then only it will give the required output.

    Demo:

    enter image description here

    If you want to get the results by matching certain words in the row, then you can use regex.

    table
| where <column_name> matches regex '+job[12]+';

    Demo:

    enter image description here

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search