not()
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Reverses the value of its bool argument.
Syntax
not(expr)
Learn more about syntax conventions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| expr | scalar | ✔️ | An expression that evaluates to a boolean value. The result of this expression is reversed. |
Returns
Returns the reversed logical value of its bool argument.
Examples
The following query returns the number of events that are not a tornado, per state.
StormEvents
| where not(EventType == "Tornado")
| summarize count() by State
Output
| State | Count |
|---|---|
| TEXAS | 4485 |
| KANSAS | 3005 |
| IOWA | 2286 |
| ILLINOIS | 1999 |
| MISSOURI | 1971 |
| GEORGIA | 1927 |
| MINNESOTA | 1863 |
| WISCONSIN | 1829 |
| NEBRASKA | 1715 |
| NEW YORK | 1746 |
| ... | ... |
The following query excludes records where either the EventType is hail, or the state is Alaska.
StormEvents
| where not(EventType == "Hail" or State == "Alaska")
The next query excludes records where both the EventType is hail and the state is Alaska simultaneously.
StormEvents
| where not(EventType == "Hail" and State == "Alaska")
Combine with other conditions
You can also combine the not() function with other conditions. The following query returns all records where the EventType is not a flood and the property damage is greater than $1,000,000.
StormEvents
| where not(EventType == "Flood") and DamageProperty > 1000000