The case-insensitive has string operator
Learn how to use the has operator to filter data with a case-insensitive string.
Filters a record set for data with a case-insensitive string. has searches for indexed terms, where an indexed term is three or more characters. If your term is fewer than three characters, the query scans the values in the column, which is slower than looking up the term in the term index.
Performance tips
When possible, use the case-sensitive has_cs.
Syntax
T | where Column has (Expression)
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| T | string | ✔️ | The tabular input whose records are to be filtered. |
| Column | string | ✔️ | The column used to filter the records. |
| Expression | scalar or tabular | ✔️ | An expression for which to search. If the value is a tabular expression and has multiple columns, the first column is used. |
Returns
Rows in T for which the predicate is true.
Examples
The following example demonstrates using has with a case-insensitive search string.
StormEvents
| summarize event_count=count() by State
| where State has "New"
| where event_count > 10
| project State, event_count
Output
| State | event_count |
|---|---|
| NEW YORK | 1,750 |
| NEW JERSEY | 1,044 |
| NEW MEXICO | 527 |
| NEW HAMPSHIRE | 394 |
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.