how to parse the json from KUSTO query

Question

In a table column, it has the json with below format:

{
"keySource": "Microsoft.Storage",
"services": {
"blob": {
"enabled": true,
"lastEnabledTime": "2022-09-27T05:54:20.5650000Z",
"keyType": "Account"
},
"file": {
"enabled": true,
"lastEnabledTime": "2022-09-27T05:54:20.5650000Z",
"keyType": "Account"
}
}
}

Question: how can I only get the enabled services name (such as "blob" and "file" in above example) in the output column?

Answer 1

datatable(mycol:dynamic)
[
    dynamic
    (
        {
        "keySource": "Microsoft.Storage",
        "services": {
            "blob": {
            "enabled": true,
            "lastEnabledTime": "2022-09-27T05:54:20.5650000Z",
            "keyType": "Account"
            },
            "file": {
            "enabled": true,
            "lastEnabledTime": "2022-09-27T05:54:20.5650000Z",
            "keyType": "Account"
            }
        }
        }
    )
]
| mv-apply service =  mycol.services on 
 (
      extend service_name = tostring(bag_keys(service)[0])
    | summarize  make_list_if(service_name, service[service_name].enabled == true) 
 )    
| project-away mycol

list_service_name
["blob","file"]

Fiddle