Forum Discussion

ScottAllison's avatar
ScottAllison
Iron Contributor
Feb 20, 2023

Need help with a parsing query

I'm having a hard time querying out this bit of JSON (extracted from a larger JSON) into their own columns:

 

[{"name":"Category","value":"Direct Agent"},{"name":"Computer","value":"servername.domeain.net"}]

 

Essentially I want to have a column named agentCategory and a column named serverName with these values in them. 

 

Thanks in advance!

Azure Resource Graph
KQL
  • Clive_Watson's avatar
    Clive_Watson
    Feb 20, 2023
    Simple but not elegant?

    let a = todynamic('[{"name":"Category","value":"Direct Agent"},{"name":"Computer","value":"servername.domeain.net"}]');
    print a=parse_json(a)
    | extend agentCategory = tostring(a[0].value)
    | extend serverName_ = tostring(a[1].value)
  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    Feb 20, 2023
    Simple but not elegant?

    let a = todynamic('[{"name":"Category","value":"Direct Agent"},{"name":"Computer","value":"servername.domeain.net"}]');
    print a=parse_json(a)
    | extend agentCategory = tostring(a[0].value)
    | extend serverName_ = tostring(a[1].value)

Resources