CODEWITHSUNDEEP
azure-devopsazure-functionskqlazure-sentineladvanced-threat-protection
John418
John418

Reputation: 33

String Manipulation in KQL

How can you Manipulate the output of a string in KQL? For example I have a query to find loggedon users for a specific group of devices and this is an output I received. I would only want Username to show in the output.

DeviceInfo
|where  DeviceID== "hksjdfhksdf"
|project DeviceName, LoggedOnUsers

[{"UserName":"djlskjfdl","DomainName":"kfjgldkjfg","Sid":"jldfkgjfd2"}]

Upvotes: 2

Views: 962

Answers (1)

Slavik N
Slavik N

Reputation: 5328

If your column is of type dynamic, then you can simply extract the first element in the array, and then extract the value of the UserName key, like this:

let str = dynamic([{"UserName":"djlskjfdl","DomainName":"kfjgldkjfg","Sid":"jldfkgjfd2"}]);
print str[0].UserName

Output:

print_0
djlskjfdl

If your column is of type string, you can make it dynamic by using todynamic().

Upvotes: 2

Related Questions