Skip to main content Link Search Menu Expand Document (external link)

Query - sContains

Table of contents
  1. sContains



  search {from="-3d@d",to="@d"} sContains("@event_type","Sign")
  let userEmail=f("@azureSignIn.userPrincipalName")

The results are as below. There are 188 records in total with the query “sContains(“@event_type”,”Sign”)”, as same as the results of “sContent(“@event_type”,”@azureSignIn”)”. That means during the past 3 days, there is only one event type(“@azureSignIn”) which contains “Sign”.