Forum Discussion

Porter76's avatar
Porter76
Brass Contributor
Sep 01, 2023

Can I add a column to A data table?

For some reason the Zsclaer data connector does not have a destination IP column in the logs. The destination IP is buried in the "AdditionalExtensions" column and this is causing an issue. 

 

Is it possible to somehow parse the data in the "AdditionalExtensions" field and populate a column named "DestinationIP" with the IP in there? 

 

 

  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor

    Porter76 

    You can use Parse or Extend for this, one example:

     

    CommonSecurityLog
    | project AdditionalExtensions
    | parse AdditionalExtensions with *'=' DestinationIP ';'*

     

    However the built-in Parsers (ASIM) also do this, depending on the product you have. 

     

    • Porter76's avatar
      Porter76
      Brass Contributor
      Thanks so much for the reply as always Clive! Very Helpful!

Resources