Forum Discussion

GouravIN's avatar
GouravIN
Brass Contributor
Nov 15, 2018

Parse ; value from output

Hi All,

 

I am creating a backup report using Log Analytics. But unfortunately I am not able to parse two column for my report and need help.

 

The original column  looks like 

 

BackupItemUniqueId_s: eastus;6XXXXXXXXXXXX481;iaasvmcontainerv2;prd-grb-0279-test-rg;servername

 

ResourceId: /SUBSCRIPTIONS/B02896-94675-497R-B4CF-A7RTD6RDH7D/RESOURCEGROUPS/PRD-GRB-0279-TEST-RG/PROVIDERS/MICROSOFT.RECOVERYSERVICES/VAULTS/Vaultname

 

I want to parse these lines output with only server and vault name (which are in bold), How can i do this.

 

 

here is the query which I am using

 

AzureDiagnostics

| where TimeGenerated > ago(1d)
| where Category == "AzureBackupReport"

| where OperationName == "Job"

| project TimeGenerated,  BackupItemUniqueId_s, ResourceId, ResourceGroup, Level

 

Thanks for the help 🙂

 

  • You can also use split in that situation:

    AzureDiagnostics
    | where TimeGenerated > ago(1d)
    | where Category == "AzureBackupReport"
    | where OperationName == "Job"
    | extend x = split(ResourceId, '/')[-1]
    | extend y = split(BackupItemUniqueId_s, ';')[-1]
    | project TimeGenerated,  BackupItemUniqueId_s, ResourceId, ResourceGroup, Level, x, y

    This will split the fields by character and return the last value of the split.

  • Hi,

    The easiest way is to use the `parse` operator, as in this query:

    AzureDiagnostics
    | where TimeGenerated > ago(12h) 
    | where OperationName == "Job"
    | project TimeGenerated,  BackupItemUniqueId_s, ResourceId, ResourceGroup, Level
    | parse ResourceId with * "/AUTOMATIONACCOUNTS/" accountName

    in your case, you'd write something like 

    ... | parse ResourceId with * "/VAULTS/" vaultName

    and the results would include a column named vaultName with the proper value. The same logic applies to servername, only the pattern is a bit different.

    More details on the `parse` operator are available here.

     

    HTH,

    Noa

     

    • GouravIN's avatar
      GouravIN
      Brass Contributor

      Hi Noa,

       

      Thanks for the swift revert , I was able to parse vault-name with the help of given suggestion however confused to parse to server name from BackupItemUniqueId_s. As we could see below this have ; everywhere as well as we do not have standard resource group naming convention. 

       

      Please help me to parse server name from below line of output.

       

      BackupItemUniqueId_s: eastus;6XXXXXXXXXXXX481;iaasvmcontainerv2;prd-grb-0279-test-rg;servername

      • You can also use split in that situation:

        AzureDiagnostics
        | where TimeGenerated > ago(1d)
        | where Category == "AzureBackupReport"
        | where OperationName == "Job"
        | extend x = split(ResourceId, '/')[-1]
        | extend y = split(BackupItemUniqueId_s, ';')[-1]
        | project TimeGenerated,  BackupItemUniqueId_s, ResourceId, ResourceGroup, Level, x, y

        This will split the fields by character and return the last value of the split.

Resources