Forum Discussion
Escape character in KQL?
Hello guys, I have a problem where I'm unable to escape characters in my KQL query. We are ingesting some custom windows event logs that are being "normalized" in XML format. However, when sent...
You can usually get rid of the "0,1,2 etc.." with mv-expand, using the Microsoft demo data as an example.
e.g.
vs.
Go to Log Analytics and run query
Clive_Watson thanks for the detailed reply. I tried using the method you listed but numbers are still there. It looks exactly the same even before using mv-expand and project operators. Only in this case you are only projecting the EventData field so ignores everything else. My goal is to be able to use the fields within 01 column. So then I can create workbooks saying
| where operation == "value"
| summarize count() by Operation