Skip to main content Link Search Menu Expand Document (external link)

Query - sEndswith

Table of contents
  1. sEndswith



  search {from="-3d@d",to="@d"} sEndswith("@event_type","SignIn")
  let userEmail=f("@azureSignIn.userPrincipalName")

The results are as below. There are 188 records in total with the query “sEndswith(“@event_type”,”Signin”)”, as same as the results of “sContent(“@event_type”,”@azureSignIn”)” or “sContains(“@event_type”,”Sign”)”. That means during the past 3 days, there is only one event type(“@azureSignIn”) which ends with “SignIn”.