Forum Discussion
eladfe
Feb 19, 2023Copper Contributor
Unpacking JSON
Hay , I am trying to unpack the JSON string IPAddresses from the table DeviceNetworkInfo: DeviceNetworkInfo | take 10 | project IP = parse_json(IPAddresses) | extend ADR = IP.IPAddress...
- Feb 21, 2023Here IP is still an array of IPAddress,SubnetPrefix,AddressType values so a simple reference to property IPAddress is not unique. You have to index to which element of IP you want, such as IP[0].IPAddress, IP[1].IPAddress, etc.
eladfe
Copper Contributor
This is my Query:
DeviceNetworkInfo| take 10
| project IP = parse_json(IPAddresses)
| extend ADR = IP[0].IPAddress, SUB = IP[0].SubnetPrefix
the result include only 3 columns : IP, ADR, SUB
DeviceNetworkInfo| take 10
| project IP = parse_json(IPAddresses)
| extend ADR = IP[0].IPAddress, SUB = IP[0].SubnetPrefix
the result include only 3 columns : IP, ADR, SUB
jbmartin6
Feb 21, 2023Iron Contributor
Add the other columns you want to the project statement, comma separated
- eladfeFeb 21, 2023Copper ContributorThe only option is to project one of the three columns that I mentioned. Nothing else.
- jbmartin6Feb 21, 2023Iron ContributorSorry I don't understand waht you mean by "the only option is to project one of the three columns", could you explain in more detail?
- eladfeFeb 22, 2023Copper ContributorI change the line : | project IP = parse_json(IPAddresses)
to : | extend IP = parse_json(IPAddresses)
and now I have all the columns .
Thank you for your help !