azure - Find all records where a column is either equal to string A or string B using kusto query language

Question

I need to find all records in a table where one of the columns CounterName contains a certain kind of string and another column InstanceName has the value equivalent to either string C: or string D:.

The below query works appropriately and returns the required records/results:

Perf
| search CounterName:"Free*bytes" and (InstanceName=="C:" or InstanceName=="D:")

However, in the above query, we need to repeat the InstanceName twice. So I attempted another query (shared below) which attempts to do the same, but it does not return any records (NO RESULTS FOUND):

Perf
| search CounterName:"Free*bytes" and InstanceName==("C:" or "D:")

Why is the second query not return any results? Is it because of the expression ("C:" or "D:") which would evaluate to a boolean?

Is there a way I can search multiple strings in a column (and select that record if any string is present) without having to repeat the column name (like we had to repeat in the first query)?

We can run the above queries online on Log Analytics in the demo section if needed (however, it may require login).

标签： azureazure-log-analyticsazure-data-explorerkql

Answer 1

The or operator is meant to be used with Boolean expressions. Using it with strings does not evaluate one result or the other.

To achieve what you are asking, try the in operator instead.

Perf
| search CounterName:"Free*bytes" and InstanceName in ("C:","D:")