contains
The contains operator applies a case-insensitive string filter and returns events that match.
The following table compares the contains operators using these abbreviations:
- RHS = right-hand side of the expression
- LHS = left-hand side of the expression
| Operator | Description | Case-Sensitive | Example (yields true) |
|---|---|---|---|
contains | RHS occurs as a subsequence of LHS | No | "FabriKam" contains "BRik" |
!contains | RHS doesn’t occur in LHS | No | "Fabrikam" !contains "xyz" |
contains_cs | RHS occurs as a subsequence of LHS | Yes | "FabriKam" contains_cs "Kam" |
!contains_cs | RHS doesn’t occur in LHS | Yes | "Fabrikam" !contains_cs "Kam" |
Syntax
Scope | where Field contains String
Arguments
- Scope: The input tabular result set to filter.
- Field: The field to filter.
- String: The string used to filter.
Example
dataset=myDataset
| summarize event_count=count() by State
| where State contains "enn"