I'm trying to figure out if this is expected behavior. My query looks like:
| parse regex "cache=......"
| where cache == "MISS, HIT, HIT"
| where cache matches "*HIT"
But it matches nothing! It looks like the operator matches the first "HIT", and then because there's more in the string, decides "no match". For example, if I change it to
| where cache matches "*T, HIT"
Then it matches.
Is this a bug?
Please sign in to leave a comment.