Forum Discussion
show on ipadress value in a column
DeviceInfo
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus == 'Can be onboarded'
| join kind=inner (DeviceNetworkInfo | distinct DeviceId, MacAddress, IPAddresses) on DeviceId
| distinct Timestamp, DeviceName, DeviceId, OSPlatform, OSDistribution, OSVersion, ReportId, MacAddress, IPAddresses
the result of IPAddresses column is
i like to have only the value only, in this example: 10.14.14.16
I have tryied with | extend IP = tostring(todynamic(IPAddresses).IPAddress), but somehow it does not show me the result. How can I do it correct , (i have not mush expirience in this part)
kind regards
| [{"IPAddress":"10.14.14.16","SubnetPrefix":null,"AddressType":"Private"}] |
i like to have only the value only, in this example: 10.14.14.16
I have tryied with | extend IP = tostring(todynamic(IPAddresses).IPAddress), but somehow it does not show me the result. How can I do it correct , (i have not mush expirience in this part)
kind regards
Steven
DeviceInfo
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus == 'Can be onboarded'
| join kind=inner (DeviceNetworkInfo | distinct DeviceId, MacAddress, IPAddresses) on DeviceId
| mvexpand parse_json(IPAddresses)
| extend IP=IPAddresses.IPAddress
| project DeviceName, OnboardingStatus, OSPlatform,OSDistribution,OSVersion, MacAddress, IP
| sort by DeviceName ascok, I have found a way , but is there a way to remove the double DeviceName's ? Distinc does not work on IP
