NQL logical operators

NQL 'in'

Use the in logical operator to check if a metric value is in the list.

Examples:

...
| where package.name in [ "MS Teams", "Zoom" ]

...
| where code in [94011, 94031]

NQL '!in'

Use the !in logical operator to check if a metric value is not in the list.

Examples:

...
| where hardware.type !in [virtual, null]

...
| where code !in [ 403, 404]

NQL 'contains'

Use the contains logical operator to check if a string is contained in an array of strings.

Example:

...
| where monitor.tags contains 'VDI'

NQL '!contains'

Use the !contains logical operator to check if a string is not contained in an array of strings.

Example:

...
| where monitor.tags !contains 'VDI'