In order to write KQL to find items where a particular field is empty (empty string matching), the following KQL should be used:
"field":""The syntax
"field":is incorrect as it is equivalent to "field":() which is an empty sequence (ex. type:(RQ,SW)). Empty sequence matching behaves differently than empty string matching.
Related to
Comments
0 comments
Article is closed for comments.