Contribute in GitHub:
Edit online
startswith operator
Filters a record set for data with a case-insensitive string starting sequence.
The following table provides a comparison of the startswith operators:
| Operator | Description | Case-Sensitive | Example (yields true) |
|---|---|---|---|
startswith |
RHS is an initial subsequence of LHS | No | "microsoftWindowsSource1" startswith "Mic" |
!startswith |
RHS isn't an initial subsequence of LHS | No | "microsoftWindowsSource1" !startswith "Cis" |
startswith_cs |
RHS is an initial subsequence of LHS | Yes | "microsoftWindowsSource1" startswith_cs "mis" |
!startswith_cs |
RHS isn't an initial subsequence of LHS | Yes | "microsoftWindowsSource1" !startswith_cs "cis" |
For further information about other operators and to determine which operator is most appropriate for your query, see datatype string operators.
Case-insensitive operators are currently supported only for ASCII-text. For non-ASCII comparison, use the tolower() function.
Performance tips
Performance depends on the type of search and the structure of the data.
For faster results, use the case-sensitive version of an operator, for example, hassuffix_cs, not hassuffix.
Syntax
T | where col startswith (expression)
Arguments
- T - The tabular input whose records are to be filtered.
- col - The column to filter.
- expression - Scalar or literal expression.
Returns
Rows in T for which the predicate is true.
Example
This example shows that the log sources returned with case insensitivity
events
| project original_time, data_source_name
| where data_source_name startswith_cs "MIC"
|take 3
Results
| original_time | data_source_name |
|---|---|
| 2023-04-07T21:31:24.620Z | microsoftWindowsSource2 |
| 2023-04-07T21:31:24.620Z | microsoftWindowsSource6 |
| 2023-04-07T21:31:24.620Z | microsoftWindowsSource8 |