On This Page

Home / Search/ Language Reference/ Operators/ String Operators/in~

in~

The in~ operator applies a case-insensitive string or regex literal filter.

The following table provides a comparison of the in operators:

OperatorDescriptionCase-SensitiveExample (yields true)
inEqual to one of the eventsYes"abc" in ("123", "345", "abc")
!inNot equal to any of the eventsYes"bca" !in ("123", "345", "abc")
in~Equal to any of the eventsNo"Abc" in~ ("123", "345", "abc")
!in~Not equal to any of the eventsNo"bCa" !in~ ("123", "345", "ABC")

Syntax
​

Scope | where Field in~ (Expression, ... )

Or:

Scope in~ ListOfValues

Arguments
​

  • Scope: The input tabular result set to filter.
  • Field: The field to filter.
  • Expression: An expression that specifies the values to search. An expression can be a type value, an expression that produces a set of values, or a regex literal expression that returns a bool value.

    To pass regex literals as Expression arguments, see syntax details at Regex Examples, Regex Flags, and Disambiguate Regex Characters.

  • ListOfValues Comma-separated list of one or more StringExpressions. For example, (StringExpression, StringExpression, ...).

Example
​

The following query shows how to use in~ with a list of values.

dataset=myDataset
  | where State in~ ("FLORIDA", "GEORGIA", "NEW YORK")
  | count

Filter the logs Dataset for host fields that have a case-insensitive match in the foo query.

let foo = dataset=api
  | summarize count=count() by hostname

dataset=logs
  | where host in~ foo.hostname