search operator provides a multi-table/multi-column search experience.
search operator is substantially less efficient than table-specific and column-specific text filtering. Whenever the tables or columns are known, it is recommended to use the union operator and where operator. Search will not function well when the workspace contains large number of tables and columns and the data volume that is being scanned is high and the time range of the query is high.
TabularSource: An optional tabular expression that acts as a data source to be searched over, such as a table name, a union operator, the results of a tabular query, etc. Cannot appear together with the optional phrase that includes TableSources.
CaseSensitivity: An optional flag that controls the behavior of all
stringscalar operators with respect to case sensitivity. Valid values are the two synonyms
case_insensitive(which is the default for operators such as
has, namely being case-insensitive) and
case_sensitive(which forces all such operators into case-sensitive matching mode).
TableSources: An optional comma-separated list of "wildcarded" table names to take part in the search. The list has the same syntax as the list of the union operator. Cannot appear together with the optional TabularSource.
SearchPredicate: A mandatory predicate that defines what to search for (in other words, a Boolean expression that is evaluated for every record in the input and that, if it returns
true, the record is outputted.) The syntax for SearchPredicate extends and modifies the normal Kusto syntax for Boolean expressions:
String matching extensions: String literals that appear as terms in the SearchPredicate indicate a term match between all columns and the literal using
hassuffix, and the inverted (
!) or case-sensitive (
sc) versions of these operators. The decision whether to apply
hassuffixdepends on whether the literal starts or ends (or both) by an asterisk (
*). Asterisks inside the literal are not allowed.
Column restriction: By default, string matching extensions attempt to match against all columns of the data set. It is possible to restrict this matching to a particular column by using the following syntax: ColumnName
String equality: Exact matches of a column against a string value (instead of a term-match) can be done using the syntax ColumnName
Other Boolean expressions: All regular Kusto Boolean expressions are supported by the syntax. For example,
"error" and x==123means: search for records that have the term
errorin any of their columns, and have the value
Regex match: Regular expression matching is indicated using Column
matches regexStringLiteral syntax, where StringLiteral is the regex pattern.
Note that if both TabularSource and TableSources are omitted, the search is carried over all unrestricted tables and views of the database in scope.
Summary of string matching extensions
||All string comparisons are case-sensitive|
Unlike the find operator, the
search operator does not support the following:
withsource=: The output will always include a column called
stringwhose value is the table name from which each record was retrieved (or some system-generated name if the source is not a table but a composite expression).
project-smart: The output schema is equivalent to
// 1. Simple term search over all unrestricted tables and views of the database in scope search "billg" // 2. Like (1), but looking only for records that match both terms search "billg" and ("steveb" or "satyan") // 3. Like (1), but looking only in the TraceEvent table search in (TraceEvent) and "billg" // 4. Like (2), but performing a case-sensitive match of all terms search "BillB" and ("SteveB" or "SatyaN") // 5. Like (1), but restricting the match to some columns search CEO:"billg" or CSA:"billg" // 6. Like (1), but only for some specific time limit search "billg" and Timestamp >= datetime(1981-01-01) // 7. Searches over all the higher-ups search in (C*, TF) "billg" or "davec" or "steveb" // 8. A different way to say (7). Prefer to use (7) when possible union C*, TF | search "billg" or "davec" or "steveb"
|1||Prefer to use a single
|2||Prefer to filter inside the