CODEWITHSUNDEEP
loggingkqlazure-log-analyticsazure-sentinelazure-log-analytics-workspace
kingliiis
kingliiis

Reputation: 41

How to read data from log analytics Custom table

I'm trying to send data across log analytics workspaces using logic app for this purpose i have used send data action that creates a custom log table.

The problem that when i wanted to use this table in KQL query i cannot access to some rows example : when i want to get Setting name from data_s row i get this error enter image description here

Row Definition

enter image description here

Does anyone know how to access these rows ?

Upvotes: 0

Views: 1119

Answers (1)

Yoni L.
Yoni L.

Reputation: 25955

if Data_s is of type string but is a valid JSON payload, you'll need to first use parse_json() on it to be able to access properties in it.

for example:

datatable(Data_s: string) ['{"SettingName":"PurgeRuns"}']
| extend Data_d = parse_json(Data_s)
| where Data_d.SettingName in ("PurgeRuns","PurgeArtifacts")

Upvotes: 1

Related Questions