KQL query, how to extend information from rendereddescription

user_18235078 0
Viewed 142

I want to extend the query result with specific values, but I do not know how to get only a fragment of information, the one that is in the screen, that is, for example, from the "rendereddescription" section, I only need information about "server_principal_name" and assign it to some value, e.g. "user" and this I know this needs to be resolved | extend "variable name" = i here i do not know what the syntax is.enter image description here

azure-log-analytics kql azure
1 Answers

you can use the parse operator: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/parseoperator

for example:

print RenderDescription = @"... 0000000000 session_server_principal_name:ABB\HPAM-TCS-DB10 server_principal_sid:01050000000 ...."
| parse RenderDescription with * "session_server_principal_name:" session_server_principal_name " " *
RenderDescription session_server_principal_name
... 0000000000 session_server_principal_name:ABB\HPAM-TCS-DB10 server_principal_sid:01050000000 .... ABB\HPAM-TCS-DB10
user_78618070
Related