I have a query as
//| parse regex "\[(?<level>[^\]]+)\]" nodrop
//| where levelor = "Error"
| timeslice | count by _timeslice
e.g. it gives me output as 1000
but when i add error or Error , its output changes. so my question here is are these search keywords case sensitive ?
Please sign in to leave a comment.