1

OMS query language doesnt have a case insensitive search option, however i see that it does support REGEX. Regex has a parameter /i to allow case insensitive searches. However I am unable to figure out how to use the regex in oms with /i

Does OMS logsearch support /i option at all? can someone give an example of usage or any other way of achieving a case insensitive search in OMS log search.

Sumesh
  • 123
  • 2
  • 13

2 Answers2

1

You can turn on case sensitivity using the regex mode modifier (?i)

for example:

where string matches regex ("(?i)query")

gorzilla
  • 98
  • 7
0

Here you go:

@   Any string of characters.   Computer=RegEx("srv@.contoso.com")  srv01.contoso.com srv02.contoso.com
.   Any single character.       Computer=RegEx("srv...contoso.com") srv01.contoso.com srv02.contoso.com

https://learn.microsoft.com/en-us/azure/log-analytics/log-analytics-log-searches-regex

4c74356b41
  • 69,186
  • 6
  • 100
  • 141
  • this doesn't address the case sensitive nature of the query. I want my results to include bot srv01 and SRV01 – Sumesh Jun 27 '17 at 10:33
  • any string of characters is exactly that. – 4c74356b41 Jun 27 '17 at 10:49
  • If I do a query Computer:Regex("@ABC@") - I get 11Million results whereas Computer:Regex("@abc@") gets me just a few thousand results. I am looking for a way to get a combined result from both, right now i am doing (Computer=*abc* or Computer=*ABC*) – Sumesh Jun 27 '17 at 12:59
  • so? i can't help you with that. you can do [a-cA-C], probably – 4c74356b41 Jun 27 '17 at 13:06