Forum Discussion
Unpacking JSON
Hay , I am trying to unpack the JSON string IPAddresses from the table DeviceNetworkInfo: DeviceNetworkInfo | take 10 | project IP = parse_json(IPAddresses) | extend ADR = IP.IPAddress...
- Here IP is still an array of IPAddress,SubnetPrefix,AddressType values so a simple reference to property IPAddress is not unique. You have to index to which element of IP you want, such as IP[0].IPAddress, IP[1].IPAddress, etc.
Great! Thank you !
I have another question: Can I still get Other columns of DeviceNetworkInfo after unpacking the Json ?
For example : Timestamp, Devicename, ADR (ADR isI P[0].IPAddress)
I have another question: Can I still get Other columns of DeviceNetworkInfo after unpacking the Json ?
For example : Timestamp, Devicename, ADR (ADR isI P[0].IPAddress)
Yes, all you are doing with parsing the JSON is adding columns, the original columns are all still ther
- This is my Query:
DeviceNetworkInfo| take 10
| project IP = parse_json(IPAddresses)
| extend ADR = IP[0].IPAddress, SUB = IP[0].SubnetPrefix
the result include only 3 columns : IP, ADR, SUB
