Forum Discussion

SergioT1228's avatar
SergioT1228
Brass Contributor
Dec 21, 2023

KQL - Storage Accounts

Hello,

 

I have a query that is working but I'm trying to extract exactly what i'm looking for to help clear up the report.

 

resources
where type =~ "microsoft.storage/storageaccounts"
extend properties = parse_json(properties)
extend PrivateEndpoint = properties.privateEndpointConnections
extend properties = parse_json(properties)
extend publicEnabled = iif(properties.networkAcls.defaultAction == "Allow""Enabled from all networks""Not enabled from all networks")
project name, properties.creationTime, subscriptionId, location, resourceGroup, https=properties.supportsHttpsTrafficOnly, properties.allowBlobPublicAccess, properties.minimumTlsVersion, publicEnabled, PrivateEndpoint
 
My issue is with the "PrivateEndpoint" results.  At the end of the day, I just need:
stpepest.3de0646c-014c-4b45-9025-5d609fab0b13
 
So I tried to do something like this but it is not working:
extend id = properties.privateEndpointConnections.id
extend p_name = split(id,'/')
extend pep_name = p_name[-1]
 
When I do a Project, I get null.  
 
any help would be greatly appreciated.
Serge
 
  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    Rather than filtering all of properties, I tend to parse for these, add this as a last line:

    | parse PrivateEndpoint with *'"name":"' pep_name '","type'*

Resources