Forum Discussion

Brass Contributor

Mar 14, 2023

Escape character in KQL?

Hello guys, I have a problem where I'm unable to escape characters in my KQL query. We are ingesting some custom windows event logs that are being "normalized" in XML format. However, when sent...

Brass Contributor

Mar 15, 2023

Clive_Watson thanks for the detailed reply. I tried using the method you listed but numbers are still there. It looks exactly the same even before using mv-expand and project operators. Only in this case you are only projecting the EventData field so ignores everything else. My goal is to be able to use the fields within 01 column. So then I can create workbooks saying

| where operation == "value"

| summarize count() by Operation

Clive_Watson

Bronze Contributor

Mar 16, 2023

Ciyaresh

The project was just an example and to simply what was returned - it wasn't intended to be a finished query. I dont have your data and it hard to read from the screenshot.

This is just a sample query on data I have - you should be able to parse the xml or json?

    Event
    | where isnotempty(EventData)
    | limit 10
    | project EventData, EventID
    | extend a=parse_xml(EventData)  // or  | extend a=parse_json(EventData)

If you get results, you should be able to right click and "extend column" the data, again just to test its possible.