| title | description | ms.reviewer | ms.topic | ms.date |
|---|---|---|---|---|
The case-insensitive !has string operators |
Learn how to use the !has string operator to filter records for data that doesn't have a matching case-insensitive string. |
alexans |
reference |
08/11/2024 |
[!INCLUDE applies] [!INCLUDE fabric] [!INCLUDE azure-data-explorer] [!INCLUDE monitor] [!INCLUDE sentinel]
Filters a record set for data that doesn't have a matching case-insensitive string. !has searches for indexed terms, where an indexed term is three or more characters. If your term is fewer than three characters, the query scans the values in the column, which is slower than looking up the term in the term index.
[!INCLUDE has-operator-comparison]
[!INCLUDE performance-tip-note]
When possible, use the case-sensitive !has_cs.
T | where column !has (expression)
[!INCLUDE syntax-conventions-note]
| Name | Type | Required | Description |
|---|---|---|---|
| T | string |
✔️ | The tabular input whose records are to be filtered. |
| column | string |
✔️ | The column by which to filter. |
| expression | scalar | ✔️ | The scalar or literal expression for which to search. |
Rows in T for which the predicate is true.
:::moniker range="azure-data-explorer"
[!div class="nextstepaction"] Run the query ::: moniker-end
StormEvents
| summarize event_count=count() by State
| where State !has "NEW"
| where event_count > 3000
| project State, event_countOutput
| State | event_count |
|---|---|
| TEXAS | 4,701 |
| KANSAS | 3,166 |