Case statement in Kusto query

Question

I have a Big list of codes in my table and I have silenced/excluded some of them by using !=

I want to check a condition for a specific error code like below. and also want other codes I have in the tables.

exceptions
| extend A_= tostring(customDimensions.A)
| extend B_ = tostring(customDimensions.B)
| where B_ != '21000' //exclude
| where B_ != '30000' //exclude
| where B_ != '40000' //exclude
| where B_ == "80000" 
    and A_ != "abcd" 
    and A_ != "wxyz"

The problem with using B_ == "80000" with "and" operator is, it is only outputting a list of code 80000 that doesn't have those 2 string which is what I wanted. but I also want to output other codes that I haven't excluded in the query.

So far I have tried using a case statement like the below;

| where error_code_ != case(B_ != "80000", A_ != "abcd" , A_ != "wxyz")

But this isn't working as I have expected. Not sure what's wrong with the query or if there is a better solution to it.

Your example use of the case statement is incorrect; it uses alternating if-then parameters for a chained test of values and results. You probably wanted the has_any function. See the docs for case and has_any — brichins

Ivan Yang Ivan Yang · Accepted Answer · 2020-12-16T02:28:43

Just use the or operator:

exceptions
| extend A_= tostring(customDimensions.A)
| extend B_ = tostring(customDimensions.B)
| where B_ != '21000' //exclude
| where B_ != '30000' //exclude
| where B_ != '40000' //exclude
| where (B_ == "80000" and A_ != "abcd" and A_ != "wxyz") or B_ !="80000"

Case statement in Kusto query

1 Answers