Forum Discussion

Copper Contributor

Nov 06, 2019

Query help

Hi all, I'm very new to Kusto and I do have the following question: With the following query: ContainerLog | where Image contains "xyz" | where LogEntry contains "ACTIVATE serviceIds" | ...

Yoni

Microsoft

Nov 06, 2019

you could try something like this:

datatable(s:string)
[
    'ACTIVATE serviceIds: [501]',
    'ACTIVATE serviceIds: [669]',
    'ACTIVATE serviceIds: [20, 662]',
    'ACTIVATE serviceIds: [20, 662]',
    'ACTIVATE serviceIds: [20, 645, 669]',
]
| parse s with * "serviceIds: " serviceIds:dynamic
| mv-expand serviceId = serviceIds to typeof(long)
| summarize count() by serviceId
| render barchart

Dalesss
Copper Contributor
Nov 06, 2019
Yoni

Thanks, mate. That's exactly what I was looking for!