Forum Discussion
Table count from custom log
Hi Rafi_Rabo,
Do we have RegExp similar to below?
1. abc_[0-9]val_* (all string or word )after this?
Expected table names
abc_1val_dd
abc_3val_xx
abc_2val_extra_cc
Thanks
Hi alchem_rj ,
The following should work: abc_[0-9]+val_.+
Here is a link to the regular expression syntax supported by Kusto: https://github.com/google/re2/wiki/Syntax
Rafi
- Rafi_RaboSep 16, 2020Microsoft
Hi alchem_rj ,
Try running the following: Go to Log Analytics and run query
I tweaked the regexp to:
abc_[0-9]+val_[0-9A-Za-z_]+
If you still have issues, please share the data and query you are trying to run.
Rafi
- alchem_rjSep 16, 2020Copper Contributor
Hi Rafi_Rabo
Thanks a lot for your help.
I also notice that if I use a similar table name in the extend operator am getting same result.
extend table_name = (extract ("(abc_8val_yy)", 0, RawData))
The output (count of table name) of above query and below query is same
extend table_name = (extract ("(abc_8val_yy_vw)", 0, RawData))
- Rafi_RaboSep 16, 2020Microsoft
Hi alchem_rj ,
This behavior is expected since the string "abc_8val_yy" is a sub-string of "abc_8val_yy_vw".
Follow the extract operator documentation for more details: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/extractfunction
Rafi
- Rafi_RaboSep 17, 2020Microsoft
Hi alchem_rj.,
You can tweak the regular expression, using the operator $ which means end of match.
In your case:
extend table_name = (extract ("(abc_8val_yy$)", 0, RawData))
Reference for regular expressions supported in Kusto: https://github.com/google/re2/wiki/Syntax
Rafi