Are `where * contains ` and `search` the same operator in KQL?

Question

Are where * contains and search the same operator in KQL?

E.g. are the following queries identical?

union *
| where * contains "foo"

and

union *
| search "foo"

I tried to find anything about the search keyword, but found nothing, since all the results are polluted with something unrelated to the keyword. It seems people usually use the word search along with anything KQL related.

While I know that the where * contains "foo" will get all results which have the case incensitive "foo" in any column's value.

I need to know the answer to this question, since the search is shorter than the where * contains and I would like to use the search instead. But I am not sure if I will get any different behavior.

Answer 1

I have reproduced in my environment and below are my observations:

Yes, where * contains "x" is similar to serach "x" as it has similar functionality but outputs are little different:

Using where * contains :

Using Search:

Here, you could clearly see 1 more column named $table is added to the table, I would say that both have similar functionality but gives different results.

One use with search is that you do not need to use pipe | operator if you are searching in table like below:

search in (Table name) "Error"

For further you can refer on search.

Note:

Where is used to find in a single table , where as Search will find in all tables in a particular cluster