Forum Discussion
Parse ; value from output
You can also use split in that situation:
AzureDiagnostics | where TimeGenerated > ago(1d) | where Category == "AzureBackupReport" | where OperationName == "Job" | extend x = split(ResourceId, '/')[-1] | extend y = split(BackupItemUniqueId_s, ';')[-1] | project TimeGenerated, BackupItemUniqueId_s, ResourceId, ResourceGroup, Level, x, y
This will split the fields by character and return the last value of the split.
Dashboards does not display summarization on more than one column. You can use this method that I've used for alerts for the dashboards as well:
Hi Stanislav,
I tried to summarize it but no luck, I found hard to get familiar with summarize command yet. Could you please help to get this done.
I will be very thankful to you!
Hi Gourav,
Please have a look at my example and notice that I am first using extend to add a new Column that concatenates two values from other two columns into single string. Than I use that new column to summarize upon with. Also when using summarize you need to provide operator for sumamarization. You can see all such operators here:
https://docs.microsoft.com/en-us/azure/kusto/query/summarizeoperator
My example is with avg(). I do not know what is your exact case but you will need to fix those things. As you have provided just the end of your query I do not know if you have done the extend thing. You can also use extend and concatenate values from more than 2 columns as well.