How to escape special characters in a KQL query?

Question

In a list I have a column with these values:

MyField ------- foo.A foo.B foo.*

I want to search for these values. I've plumbed all managed properties and crawled content.

If I search myfield:"foo.", all results are returned ==> Expected
If I search myfield:"foo.A", results with the foo.A are returned.==> Expected
If I search myfield:"foo.*", both foo.A and foo.B are returned, but not foo.* ==> not Expected. I need to get only foo.*

How to search for literal *?

I also tried : myfield:"foo.\*", myfield:"\foo.*", myfield:{"foo.*"}, but none worked.

Documentation does not mention any way to escape special characters.

Or try myfield:"foo.%2A", I have replaced \"*\" with its encoding value, since \"*\" (asterisk) is a wild card keyword in KQL, is will search for all text starting foo. let me knw if it works. Havent tried this scenario yet — Gaurravs
– Gaurravs, Commented Apr 5, 2016 at 9:57

Michael Maher · Accepted Answer · 2019-12-17 14:41:51Z

KQL is also used when doing compliance searches in Microsoft Exchange.

I was able to use `$ to escape characters when doing searches in Exchange

"foo`$*"

Shrikant Prabhu · Accepted Answer · 2020-07-12 06:03:39Z

0

I was able to do it with just ` in Kibana logs with KQL syntax

answered Jul 12, 2020 at 6:03

101

2 Answers 2