=~ (equals) operator
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Filters a record set for data with a case-insensitive string.
The following table provides a comparison of the ==
(equals) operators:
Operator | Description | Case-Sensitive | Example (yields true ) |
---|---|---|---|
== |
Equals | Yes | "aBc" == "aBc" |
!= |
Not equals | Yes | "abc" != "ABC" |
=~ |
Equals | No | "abc" =~ "ABC" |
!~ |
Not equals | No | "aBc" !~ "xyz" |
For more information about other operators and to determine which operator is most appropriate for your query, see datatype string operators.
Performance tips
Note
Performance depends on the type of search and the structure of the data. For best practices, see Query best practices.
When possible, use == - a case-sensitive version of the operator.
Syntax
T |
where
col =~
(
expression)
Learn more about syntax conventions.
Parameters
Name | Type | Required | Description |
---|---|---|---|
T | string |
✔️ | The tabular input whose records are to be filtered. |
col | string |
✔️ | The column to filter. |
expression | string |
✔️ | The expression used to filter. |
Returns
Rows in T for which the predicate is true
.
Example
The State
values in the StormEvents
table are capitalized. The following query matches
columns with the value "KANSAS".
StormEvents
| where State =~ "kansas"
| project EventId, State
The following table only shows the first 10 results. To see the full output, run the query.
EventId | State |
---|---|
70787 | KANSAS |
43450 | KANSAS |
43451 | KANSAS |
38844 | KANSAS |
18463 | KANSAS |
18464 | KANSAS |
18495 | KANSAS |
43466 | KANSAS |
43467 | KANSAS |
43470 | KANSAS |