How to extract a field without the +- buttons

Question

Hello, I'm new to this.&nbsp;I was trying the following line as part of my query:&nbsp;&nbsp; | project TargetUsername = parse_json(TargetResources).["userPrincipalName"]without success, I also noticed that unlike other attributes, i don't have the +- in this one.How can i extract the attribute in the userPrincipalName? (Its an Azure AD-Add user event)&nbsp;&nbsp;Thank you.

clivewatson · Accepted Answer

Deleted&nbsp;
&nbsp;
Hi,
&nbsp;
This example might help you.&nbsp;
AuditLogs
| where SourceSystem == "Azure AD" 
| extend PropertiesJSON = parse_json(TargetResources)
| extend myUser = PropertiesJSON[0].userPrincipalName
| where isnotempty(myUser)
| project myUser
&nbsp;
&nbsp;
if the data was a level lower the technique is:
AzureActivity
| where ResourceId has "virtualmachines"
| where Properties has "policyAssignmentSku" 
| extend PropertiesJSON = parse_json(Properties)
| extend PoliciesJson = parse_json(tostring(PropertiesJSON.policies)) 
| extend PolicyAssignmentSkuTier = PoliciesJson[0].policyAssignmentSku.tier
| extend PolicyAssignmentSkuName = PoliciesJson[0].policyAssignmentSku.name
| project PolicyAssignmentSkuTier, PolicyAssignmentSkuName, PoliciesJson

Forum Discussion

How to extract a field without the +- buttons

2 Replies