Forum Discussion
GouravIN
Nov 15, 2018Brass Contributor
Parse ; value from output
Hi All,
I am creating a backup report using Log Analytics. But unfortunately I am not able to parse two column for my report and need help.
The original column looks like
BackupItemUniqueId_s: eastus;6XXXXXXXXXXXX481;iaasvmcontainerv2;prd-grb-0279-test-rg;servername
ResourceId: /SUBSCRIPTIONS/B02896-94675-497R-B4CF-A7RTD6RDH7D/RESOURCEGROUPS/PRD-GRB-0279-TEST-RG/PROVIDERS/MICROSOFT.RECOVERYSERVICES/VAULTS/Vaultname
I want to parse these lines output with only server and vault name (which are in bold), How can i do this.
here is the query which I am using
AzureDiagnostics
| where TimeGenerated > ago(1d)
| where Category == "AzureBackupReport"
| where OperationName == "Job"
| project TimeGenerated, BackupItemUniqueId_s, ResourceId, ResourceGroup, Level
Thanks for the help 🙂
You can also use split in that situation:
AzureDiagnostics | where TimeGenerated > ago(1d) | where Category == "AzureBackupReport" | where OperationName == "Job" | extend x = split(ResourceId, '/')[-1] | extend y = split(BackupItemUniqueId_s, ';')[-1] | project TimeGenerated, BackupItemUniqueId_s, ResourceId, ResourceGroup, Level, x, y
This will split the fields by character and return the last value of the split.
- Noa Kuperberg
Microsoft
Hi,
The easiest way is to use the `parse` operator, as in this query:
AzureDiagnostics | where TimeGenerated > ago(12h) | where OperationName == "Job" | project TimeGenerated, BackupItemUniqueId_s, ResourceId, ResourceGroup, Level | parse ResourceId with * "/AUTOMATIONACCOUNTS/" accountName
in your case, you'd write something like
... | parse ResourceId with * "/VAULTS/" vaultName
and the results would include a column named vaultName with the proper value. The same logic applies to servername, only the pattern is a bit different.
More details on the `parse` operator are available here.
HTH,
Noa
- GouravINBrass Contributor
Hi Noa,
Thanks for the swift revert , I was able to parse vault-name with the help of given suggestion however confused to parse to server name from BackupItemUniqueId_s. As we could see below this have ; everywhere as well as we do not have standard resource group naming convention.
Please help me to parse server name from below line of output.
BackupItemUniqueId_s: eastus;6XXXXXXXXXXXX481;iaasvmcontainerv2;prd-grb-0279-test-rg;servername
You can also use split in that situation:
AzureDiagnostics | where TimeGenerated > ago(1d) | where Category == "AzureBackupReport" | where OperationName == "Job" | extend x = split(ResourceId, '/')[-1] | extend y = split(BackupItemUniqueId_s, ';')[-1] | project TimeGenerated, BackupItemUniqueId_s, ResourceId, ResourceGroup, Level, x, y
This will split the fields by character and return the last value of the split.