Parse data from a field using KQL

Question

Parse data from a field using KQL

AzureSent-0127 41

How can I extract (parse out) pieces of data from a field and then put them in their own dedicated column in KQL? (Please see attached image for details) Syslog_Parsing

2 answers

Your answer

Answer 1

Samy Abdul 3,376

Hi @AzureSent-0127 , parse operator would be the thing you should be looking at :

Syntax

T | parse [ kind=kind [ flags=regexFlags ]] expression with [ * ] stringConstant columnName [: columnType] [ * ] , ...

Please go through below link for further details:

https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/parseoperator#syntax Thanks

AzureSent-0127 41 Reputation points

2023-05-23T14:30:02.6966667+00:00

@Samy Abdul

Thank you for the info. Unfortunately, my attempts haven't been so successful. Can you please show me what the query would look like in my case by any chance?

Answer 2

Tom 20

i'm using a log analytics workspace, and KQL to retrieve / troubleshoot. In the ResultDescription column I have a string. I want to extract data and put them (extend) in there own column. The accountname and Caller Computer Name, could someone help me out?

Best Regards,

Onedutch

log analytics workspace Screenshot 2023-05-25 155247

Sander van de Velde | MVP 36,951 Reputation points MVP Volunteer Moderator

2023-07-07T22:36:50.9+00:00

Hello Tom, can you turn your question in a separate thread (a new question) instead of adding it as an answer to the question above? Thanks.

Share via

Parse data from a field using KQL

2 answers

Your answer