Frequently Asked Questions

How do I write KQL to find items with empty fields?

In order to write KQL to find items where a particular field is empty (empty string matching), the following KQL should be used:

"field":""

The syntax

"field":

is incorrect as it is equivalent to "field":() which is an empty sequence (ex. type:(RQ,SW)). Empty sequence matching behaves differently than empty string matching.