Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
In this article
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Reverses the value of its bool
argument.
not(
expr)
Learn more about syntax conventions.
Name | Type | Required | Description |
---|---|---|---|
expr | scalar | ✔️ | An expression that evaluates to a boolean value. The result of this expression is reversed. |
Returns the reversed logical value of its bool
argument.
The following query returns the number of events that are not a tornado, per state.
StormEvents
| where not(EventType == "Tornado")
| summarize count() by State
Output
State | Count |
---|---|
TEXAS | 4485 |
KANSAS | 3005 |
IOWA | 2286 |
ILLINOIS | 1999 |
MISSOURI | 1971 |
GEORGIA | 1927 |
MINNESOTA | 1863 |
WISCONSIN | 1829 |
NEBRASKA | 1715 |
NEW YORK | 1746 |
... | ... |
The following query excludes records where either the EventType is hail, or the state is Alaska.
StormEvents
| where not(EventType == "Hail" or State == "Alaska")
The next query excludes records where both the EventType is hail and the state is Alaska simultaneously.
StormEvents
| where not(EventType == "Hail" and State == "Alaska")
You can also combine the not() function with other conditions. The following query returns all records where the EventType is not a flood and the property damage is greater than $1,000,000.
StormEvents
| where not(EventType == "Flood") and DamageProperty > 1000000