Forum Discussion
Extract json from windows event log (SecurityEvent)
Hello everyone, We are currently trying to parse logs that are being ingested into SecurityEvent table with following information all being in a single field called "EventData". We have tried usi...
Hello Ciyaresh,
Have you tried to use parse_xml()?
parse_xml() - Azure Data Explorer | Microsoft Learn
For example, try to launch this query and see if it returns a parsed EventData xml. Send the result.
YourTableName | extend Data=parse_xml(EventData) | project Data
Hello Ciyaresh,
Have you tried to use parse_xml()?
parse_xml() - Azure Data Explorer | Microsoft Learn
For example, try to launch this query and see if it returns a parsed EventData xml. Send the result.
YourTableName | extend Data=parse_xml(EventData) | project Data
