diff --git a/data-explorer/kusto/includes/direct-ingestion-note.md b/data-explorer/kusto/includes/direct-ingestion-note.md index c3123dd1e1..78d37bd8f2 100644 --- a/data-explorer/kusto/includes/direct-ingestion-note.md +++ b/data-explorer/kusto/includes/direct-ingestion-note.md @@ -1,7 +1,15 @@ --- ms.topic: include -ms.date: 08/11/2024 +ms.date: 09/12/2024 +monikerRange: "microsoft-fabric || azure-data-explorer" --- - + +:::moniker range="microsoft-fabric" > [!NOTE] > This ingestion method is intended for exploration and prototyping. Don't use it in production or high-volume scenarios. +:::moniker-end + +:::moniker range="azure-data-explorer" +> [!NOTE] +> This ingestion method is intended for exploration and prototyping. Don't use it in production or high-volume scenarios. For more information about ingestion options, see [Data ingestion overview](/azure/data-explorer/ingest-data-overview). +:::moniker-end diff --git a/data-explorer/kusto/query/not-function.md b/data-explorer/kusto/query/not-function.md index 132e373210..c6e2360142 100644 --- a/data-explorer/kusto/query/not-function.md +++ b/data-explorer/kusto/query/not-function.md @@ -3,7 +3,7 @@ title: not() description: Learn how to use the not() function to reverse the value of its boolean argument. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 11/26/2024 --- # not() @@ -21,22 +21,73 @@ Reverses the value of its `bool` argument. | Name | Type | Required | Description | |--|--|--|--| -|*expr*|scalar| :heavy_check_mark:|An expression that evaluates to a boolean value. The result of this expression will be reversed.| +|*expr*|scalar| :heavy_check_mark:|An expression that evaluates to a boolean value. The result of this expression is reversed.| ## Returns Returns the reversed logical value of its `bool` argument. -## Example +## Examples -> Run the query +The following query returns the number of events that are not a tornado, per state. + +:::moniker range="azure-data-explorer" +> Run the query +:::moniker-end ```kusto -print not(false) == true +StormEvents +| where not(EventType == "Tornado") +| summarize count() by State ``` **Output** -|print_0| -|--| -|true| +| State | Count | +|--|--| +| TEXAS | 4485 | +| KANSAS | 3005 | +| IOWA | 2286 | +| ILLINOIS | 1999 | +| MISSOURI | 1971 | +| GEORGIA | 1927 | +| MINNESOTA | 1863 | +| WISCONSIN | 1829 | +| NEBRASKA | 1715 | +| NEW YORK | 1746 | +| ... | ... | + +The following query excludes records where either the EventType is hail, *or* the state is Alaska. + +:::moniker range="azure-data-explorer" +> Run the query +:::moniker-end + +```kusto +StormEvents +| where not(EventType == "Hail" or State == "Alaska") +``` + +The next query excludes records where both the EventType is hail *and* the state is Alaska simultaneously. + +:::moniker range="azure-data-explorer" +> Run the query +:::moniker-end + +```kusto +StormEvents +| where not(EventType == "Hail" and State == "Alaska") +``` + +### Combine with other conditions + +You can also combine the not() function with other conditions. The following query returns all records where the EventType is not a flood and the property damage is greater than $1,000,000. + +:::moniker range="azure-data-explorer" +> Run the query +:::moniker-end + +```kusto +StormEvents +| where not(EventType == "Flood") and DamageProperty > 1000000 +```