Forum Discussion

Copper Contributor

Sep 01, 2020

Table count from custom log

Hello, I would like to get the count of table name reference in my custom log which is pushed to the Log analytics. The custom log structure is given below. 020-08-31 16:15:38 ProxyEngine [I...

Copper Contributor

Sep 16, 2020

When I use the Regex you have provided I am getting all the value in the RawData along with the table name. I am not able to filter the exact table name from the RawData.

Icon for Microsoft rank

Microsoft

Sep 16, 2020

Try running the following: Go to Log Analytics and run query

I tweaked the regexp to:

abc_[0-9]+val_[0-9A-Za-z_]+

If you still have issues, please share the data and query you are trying to run.

Rafi

Rafi_Rabo
Microsoft
Sep 17, 2020
Hi alchem_rj.,

You can tweak the regular expression, using the operator $ which means end of match.

In your case:

extend table_name = (extract ("(abc_8val_yy$)", 0, RawData))

Reference for regular expressions supported in Kusto: https://github.com/google/re2/wiki/Syntax

Rafi
alchem_rj
Copper Contributor
Sep 17, 2020
Hi Rafi_Rabo,

Is it possible to fetch the exact matching string from Rawdata using "extract" operator? or any other command?
Rafi_Rabo
Microsoft
Sep 16, 2020
Hi alchem_rj ,

This behavior is expected since the string "abc_8val_yy" is a sub-string of "abc_8val_yy_vw".

Follow the extract operator documentation for more details: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/extractfunction

Rafi
alchem_rj
Copper Contributor
Sep 16, 2020
Hi Rafi_Rabo

Thanks a lot for your help.

I also notice that if I use a similar table name in the extend operator am getting same result.

extend table_name = (extract ("(abc_8val_yy)", 0, RawData))

The output (count of table name) of above query and below query is same

extend table_name = (extract ("(abc_8val_yy_vw)", 0, RawData))

Resources