set_difference()
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Returns a dynamic (JSON) array of the set of all distinct values that are in the first array but aren't in other arrays - (((arr1 \ arr2) \ arr3) \ ...).
Syntax
set_difference(set1, set2 [,set3, ...])
Learn more about syntax conventions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| set1...setN | dynamic |
✔️ | Arrays used to create a difference set. A minimum of 2 arrays are required. See pack_array. |
Returns
Returns a dynamic array of the set of all distinct values that are in set1 but aren't in other arrays.
Example
range x from 1 to 3 step 1
| extend y = x * 2
| extend z = y * 2
| extend w = z * 2
| extend a1 = pack_array(x,y,x,z), a2 = pack_array(x, y), a3 = pack_array(x,y,w)
| project set_difference(a1, a2, a3)
Output
| Column1 |
|---|
| [4] |
| [8] |
| [12] |
print arr = set_difference(dynamic([1,2,3]), dynamic([1,2,3]))
Output
| arr |
|---|
| [] |