CODEWITHSUNDEEP
kql
Symon Turner
Symon Turner

Reputation: 175

Get variable elements fron string / url using KQl

I have various API calls (not written by me) which I want to analyse. The trouble is the bit of the URL that tells me is at the end of the URL

E.G:

/API/XXX/1111/XXX/XX/XXX/XXX/XXX/XXX/stringIwant/XXXX /API/XXXX/1111/XXXX/xxx55566/StringIwant /API/XXXX/111/XXX/XXX/XXX/xxx123/zzz/xx34/StringIwant

As you can see the string I want is at the end and of various lengths (and in some the 2nd to the end)

any idea on how to get it out?

Ive tried regex and even suffix which works as a filter (mostly) but not to extract the value

Upvotes: 0

Views: 275

Answers (1)

Symon Turner
Symon Turner

Reputation: 175

It is a smiged insane buuut

AzureDiagnostics
| where strlen(requestUri_s) >0
| project splitted=split(requestUri_s, '/'), requestUri_s
| mv-expand col1=splitted[0], col2=splitted[1], col3=splitted[2],col4=splitted[3],col5=splitted[4],col6=splitted[5],col7=splitted[6],col8=splitted[7],col9=splitted[8],col10=splitted[9],col11=splitted[10],col12=splitted[11],col13=splitted[12]
| project-away splitted
|where col2 =="API"
|extend a= case(strlen(col11)==0,col7,
                strlen(col12) ==0 or strlen(col12)>30,col11,
                     strlen(col13)==0,col12,
                    col13)

With thanks to Split column string with delimiters into separate columns in azure kusto

this does what I want

Upvotes: 0

Related Questions