Logic apps - condition not working

Question

Hello,

What i'm trying to do is when an incident is triggered->check with query if its related to OracleDBAudit table. If not - don't send email. If yes - send email.
Below you can find the logic app flow i'm trying to implement:

Run query and list results contains:

SecurityAlert
| where AlertName contains "OracleDBAudit"
| where IsIncident == true

• In my case this is returning no results when inserted in LOGS, thus send no email. However I get an email no matter what.

Below you can find the output from the Run query and list results which returns nothing and still the condition is TRUE?

Answer 1

Hi @Georgi Palazov ,

I don't think you can use a blank entry for your 'is not equal to'.
It must specify a 'null' value as a function.

Here's an excellent example:

how-to-deal-with-possible-null-values-in-control-c.html