GitHubContribute in GitHub: Edit online

!startswith operator

Filters a record set retrieving data that does not start a case-insensitive search string.

The following table provides a comparison of the startswith operators:

  • RHS = right hand side of the expression
  • LHS = left hand side of the expression
Operator Description Case-Sensitive Example (yields true)
startswith RHS is an initial subsequence of LHS No "microsoftWindowsSource1" startswith "Mic"
!startswith RHS isn't an initial subsequence of LHS No "microsoftWindowsSource1" !startswith "Cis"
startswith_cs RHS is an initial subsequence of LHS Yes "microsoftWindowsSource1" startswith_cs "mis"
!startswith_cs RHS isn't an initial subsequence of LHS Yes "microsoftWindowsSource1" !startswith_cs "cis"

* RHS = right hand side of the expression * LHS = left hand side of the expression

For further information about other operators and to determine which operator is most appropriate for your query, see datatype string operators.

Case-insensitive operators are currently supported only for ASCII-text. For non-ASCII comparison, use the tolower() function.

Performance tips

Performance depends on the type of search and the structure of the data.

For faster results, use the case-sensitive version of an operator, for example, hassuffix_cs, not hassuffix.

If you're testing for the presence of a symbol or alphanumeric word that is bound by non-alphanumeric characters at the start or end of a field, for faster results use has or in.

Syntax

T | where col !startswith (expression)

Arguments

  • T - The tabular input whose records are to be filtered.
  • col - The column to filter.
  • expression - Scalar or literal expression.

Returns

Rows in T for which the predicate is true.

Example

This example illustrates how the og source names are matched withoiut case sensityvity.

events
| project original_time, data_source_name
| where data_source_name !startswith "Cis"
| take 3

Results

original_time data_source_name
2023-04-05T23:59:54.549Z microsoftWindowsSource3
2023-04-05T23:59:54.550Z microsoftWindowsSource6
2023-04-05T23:59:54.550Z microsoftWindowsSource5