Logical (binary) operators

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

The following logical operators can be used to perform comparisons and evaluations:

Operator name	Syntax	Meaning
Equality	`==`	Returns `true` if both operands are non-null and equal to each other. Otherwise, returns `false`.
Inequality	`!=`	Returns `true` if any of the operands are null or if the operands aren't equal to each other. Otherwise, returns `false`.
Logical and	`and`	Returns `true` only if both operands are `true`.
Logical or	`or`	Returns `true` if either of the operands is `true`, regardless of the other operand.

Note

These logical operators are sometimes referred-to as Boolean operators, and sometimes as binary operators. The terms are interchangeable.

How logical operators work with null values

Null values adhere to the following rules:

The following query returns a count of all storm events where the event type is "Tornado".

StormEvents
| where EventType == "Tornado"
| count

Output

Count
1238

The following query returns a count of all storm events where the event type isn't "Tornado".

StormEvents
| where EventType != "Tornado"
| count

Output

Count
57828

The following query returns a count of all storm events where the event type is "Tornado" and the state is "KANSAS".

StormEvents
| where EventType == "Tornado" and State == "KANSAS"
| count

Output

Count
161

The following query returns a count of all storm events where the event type is "Tornado" or "Thunderstorm Wind".

StormEvents
| where EventType == "Tornado" or EventType == "Thunderstorm Wind"
| count

Output

Count
14253

The following query shows that null values are treated as false.

print iff(bool(null) and true, true, false)

Output

print_0
false