Forum Discussion

Copper Contributor

Sep 01, 2020

Table count from custom log

Hello, I would like to get the count of table name reference in my custom log which is pushed to the Log analytics. The custom log structure is given below. 020-08-31 16:15:38 ProxyEngine [I...

azure monitor

Log Analytics

Rafi_Rabo

Microsoft

Sep 16, 2020

Hi alchem_rj ,

This behavior is expected since the string "abc_8val_yy" is a sub-string of "abc_8val_yy_vw".

Follow the extract operator documentation for more details: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/extractfunction

Rafi

alchem_rj

Copper Contributor

Sep 17, 2020

Hi Rafi_Rabo,

Is it possible to fetch the exact matching string from Rawdata using "extract" operator? or any other command?

Rafi_Rabo
Microsoft
Sep 17, 2020
Hi alchem_rj.,

You can tweak the regular expression, using the operator $ which means end of match.

In your case:

extend table_name = (extract ("(abc_8val_yy$)", 0, RawData))

Reference for regular expressions supported in Kusto: https://github.com/google/re2/wiki/Syntax

Rafi