Kusto: regex returns incorrect results

Question

Hi all,

I've created a Kusto search that uses the regex command. The search worked flawlessly until a few days back. I'm now getting results which do not match the regex query.

The regex query should only return computers starting with HYPERV, DC, GW, SPLUNK, or SQL. However, other machines are returned, too. See screenshot.

When I remove |^DC* from the regex query, the three machines are no longer returned. But, I'm then missing any machines starting with DC, too, of course.

Any ideas?

Answer 1

From my experience, a wildcard by itself isn't correct, it should be ".*".
The star usually means "match the previous character 1 or more times".
By adding a dot you're saying "match any character 1 or more times".
You don't even need the wildcard for what you're trying to do.

Try testing your regex'es at regex101.com or any online regex site.

Matches:

Doesn't Match:

Answer 2

It's weird, your query looks correct. Open a support ticket please

Answer 3

Hi Dominik,
I don't understand your use of the wildcard.
I would either remove the wildcard entirely or use ".*" (one or more string matches)
You shouldn't need the wildcard, IMO.