How do I write KQL to find items with empty fields?

Emma Rothkopf
Emma Rothkopf
  • Updated

In order to write KQL to find items where a particular field is empty (empty string matching), the following KQL should be used:

"field":""

The syntax

"field":

is incorrect as it is equivalent to "field":() which is an empty sequence (ex. type:(RQ,SW)). Empty sequence matching behaves differently than empty string matching.

 

Related to

Was this article helpful?

0 out of 0 found this helpful

Have more questions? Submit a request

Comments

0 comments

Article is closed for comments.