Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Kusto !has_any | where value does not contain any value in set

Is there a built-in way in Kusto to check that a value does not contain multiple items? I know that I can use has_any to check if an item contains any values in a set, but I can't seem to get it to work with an "!" operator. Example:

let Employees = datatable(Id:int, Name:string, Position:string ) 
[
   1, "Bob", "General Manager",
   2, "Mary", "Coordinator",
   3, "John", "Sales Representitive"
];
Employees
| where Position !has_any("Manager", "Sales")

Expected output:

Expected output

If I remove the not operator (!) it works, and returns info for Bob and John. But I want to reverse it from has any/contains any to does not contain any. I have also tried

| where Position has_any !("Manager", "Sales")

But it seems like any combination of has_any and "!" throws a syntax error and won't run. Is there a way to do this without listing out individual !contains statements? i.e. this is not what I am looking for:

| where Position !contains "Manager" and Position !contains "Sales"

This isn't a big deal for just two conditions but when you're dealing with a long list it would be much better to use has_any with a simple exclamation mark in front of it.


-- UPDATE --

I only recently found out that has_any actually does not pick up if a field contains any item in a set. To be technically correct, it only picks up if the field has any whole word matches from the set. To clarify, here is an example:

let TestTable = datatable(Id:int, FirstName:string, LastName:string ) 
[
   1, "John", "De La Cruz",
   2, "Susana", "Vanderbelt",
   3, "Stan", "Manlyman",
   4, "Henry", "Van De Camps",
   5, "Alissa", "New man"
];
TestTable
| where not(LastName has_any("de", "man"))

Take careful note of the results:

Table results

If you where to replace the last line with this

| where LastName !contains("de") and LastName !contains("man")

It would yield nothing in the results set. So if you're really going for "where field doesn't contain any value in the set" then as far as I know you have to write out each one individually, there is no such keyword where you can pass in a set for that functionality. If anyone knows of such a keyword please let me know in the comments or a new answer and I will update this question.

like image 589
SendETHToThisAddress Avatar asked Dec 04 '20 21:12

SendETHToThisAddress


People also ask

Which type of datatype is allowed in kusto?

A data type is either a scalar data type (one of the built-in predefined types listed below), or a user-defined record (an ordered sequence of name/scalar-data-type pairs, such as the data type of a row of a table). Kusto supplies a set of system data types that define all the types of data that can be used with Kusto.

What is kusto?

Azure Data Explorer a.k.a Kusto is a log analytics cloud platform optimized for ad-hoc big data queries.

What is kusto function?

Kusto supports several kinds of functions: Stored functions are user-defined functions that are stored and managed database schema entities. See Stored functions. Query-defined functions are user-defined functions that are defined and used within the scope of a single query.

Is null in kusto?

All scalar data types in Kusto have a special value that represents a missing value. This value is called the null value, or null.


1 Answers

you could use not(): https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/notfunction

for example:

let Employees = datatable(Id:int, Name:string, Position:string ) 
[
   1, "Bob", "General Manager",
   2, "Mary", "Coordinator",
   3, "John", "Sales Representitive"
];
Employees
| where not(Position has_any("Manager", "Sales"))
like image 93
Yoni L. Avatar answered Nov 23 '22 14:11

Yoni L.