CODEWITHSUNDEEP
kql
user8369515
user8369515

Reputation: 535

using columns for comparisons KQL

The following works ...

datatable(RawData:string, Comparison:string) [
"Everyone is happy but me", "Everyone is happy"
]
| where RawData contains Comparison

Except when there is a character such as \ in either the comparison or the rawdata. Is there a way to nullify this?

 datatable(RawData:string, Comparison:string) [
    "\Everyone is happy but me", "\Everyone is happy"
    ]
    | where RawData contains Comparison

Upvotes: 0

Views: 271

Answers (1)

David דודו Markovitz
David דודו Markovitz

Reputation: 44941

You need to use verbatim string literals

datatable(RawData:string, Comparison:string) [
    @"\Everyone is happy but me", @"\Everyone is happy"
    ]
    | where RawData contains Comparison
RawData Comparison
\Everyone is happy but me \Everyone is happy

Fiddle

Or you can use double-escaping

The backslash () character indicates escaping. The backslash is used to escape the enclosing quote characters, tab characters (\t), newline characters (\n), and itself (\\).

datatable(RawData:string, Comparison:string) [
    "\\Everyone is happy but me", "\\Everyone is happy"
    ]
    | where RawData contains Comparison
RawData Comparison
\Everyone is happy but me \Everyone is happy

Fiddle

Upvotes: 0

Related Questions