This article has not been completed yet. However, it may already contain helpful Information and therefore it has been published at this stage.
Basic string operators:
- matches regex
# How many log entries are in the Log Analytic Workspace? search * | summarize count()
How many tables are in the Log Analytic Workspace? search *| summarize dcount($table)
# Show all tables by name and sort them by count in descending order. search *| summarize count() by $table | sort by count_ desc
# Look for all tables that contains a certain string search * | where * contains "iot2" | distinct $table
# Look for all entries in a specific table (eset_CL), where a specific column (hostname_s) has entries, that starts with "iot" eset_CL| where hostname_s startswith "iot"
# Look for all entries in a specific table (eset_CL), in a specific columns (hostname_s, occured_s) and sort them using a specific coloumn (occured_s) eset_CL| project hostname_s, occured_s | sort by occured_s