CODEWITHSUNDEEP
azure-log-analytics
deniscooper
deniscooper

Reputation: 49

Azure Log Analytics - expanding a property

I'm fairly new to using log analytics and not very familiar with the KQL language yet for queries.

I'm trying to do a query that will get the objectID value out of what appears to be a multi-valued property from the query. When I do a standard search to list the results in a table one of the columns is Properties, and the objectID is within that property column.

Not sure how to go about doing this so the results just show the objectID.

enter image description here

Upvotes: 2

Views: 1873

Answers (1)

Bhargavi Annadevara
Bhargavi Annadevara

Reputation: 5502

It would have helped to see your initial kusto query included in the question.

Nevertheless, you can use the project operator of KQL to extract the ObjectId as:

T
| ..<the rest of your query>..
| project Properties.ObjectId

where T is the table you are trying to query.

Here are some resources for you to get started with Kusto Query Language:

Upvotes: 2

Related Questions