The case-insensitive has string operator

Filters a record set for data with a case-insensitive string. has searches for indexed terms, where an indexed term is three or more characters. If your term is fewer than three characters, the query scans the values in the column, which is slower than looking up the term in the term index.

Performance tips

When possible, use the case-sensitive has_cs.

Syntax

T | where Column has (Expression)

Parameters

Returns

Rows in T for which the predicate is true.

Example

StormEvents
| summarize event_count=count() by State
| where State has "New"
| where event_count > 10
| project State, event_count

Output