python (12.9k questions)

javascript (9.2k questions)

reactjs (4.7k questions)

java (4.2k questions)

java (4.2k questions)

c# (3.5k questions)

c# (3.5k questions)

html (3.3k questions)

Questions - azure-data-explorer

Search Query help - Condition Card Builder - KQL?

I’m trying to get a proper search done by the IT department. I have been told that they use condition card builder and Kusto query language. I need to search for “wordA” near 5 words of “wordB” (eithe...
test-img

Serena Greene

azure-data-explorer

Votes: 0

Answers: 1

Latest Answer

The query (wordA NEAR(5) wordB)(senderauthor=fromemailaddress) can be copied and pasted into the keyword section of the condition card builder. Connect, build and run the search in PowerShell: connect...
test-img

Derek Vanderkruk

Exclude certain days/time from query results? (Ex. Thursday's midnight-2am EST)

I am newer to KQL and I am trying to write a query against configuration changes made to files with an extension of ".config" and would like to remove results that are generated under the &q...
test-img

VoD

datetime

azure-data-explorer

kql

Votes: 0

Answers: 1

Latest Answer

Replace 4d with 4, because dayofweek() returns the number of day (between 0 and 6).
test-img

Slavik N

Kusto Query Specific child records

Is there a way to setup a where clause in Kusto to get specific records with child records Like if I wanted Kyle from below Where address has Code = street and that value= grant AND Code = Number and...
test-img

Zach

azure-data-explorer

kusto-explorer

Votes: 0

Answers: 1

Latest Answer

you could try using mv-apply, and filter for records in which the number of conditions met is as expected: datatable(i:int, d:dynamic) [ 1, dynamic({"Firstname": "Bob", "...
test-img

Yoni L.

Kusto query to exclude results from a certain time (Ex. Thursday from midnight-2am EST)

I am newer to KQL and I am trying to write a query against configuration changes made to files with an extension of ".config" and would like to remove results that are generated under the &q...
test-img

VoD

datetime

configuration

azure-data-explorer

Votes: 0

Answers: 1

Latest Answer

Try adding the following filter, using dayofweek() and hourofday(). Note: The example below works in UTC. You can add the current offset of UTC -> EST to TimeGenerated as part of the filter Configu...
test-img

Yoni L.

Posts

Questions

Blogs

Jobs