Forum Discussion
Solved
How can I get a specific parameter field using KQL ?
Hello everyone, I'd like to make a little table dashboard with the following request OfficeActivity | where OfficeWorkload == "Exchange" | where Operation == "Add-MailboxPermission" Then pr...
Alexander_Ceyran you can do something like this. Since Parameters stores a JSON array you can convert it to a dynamic type and then use the mv-expand command to expand each entry in the array into its own row and then filter the rows
OfficeActivity| where OfficeWorkload == "Exchange"| where Operation == "Add-MailboxPermission"| extend test = (todynamic(Parameters))| mv-expand(test)| where test contains "DomainController"
Hi Alexander_Ceyran,
If you move your mouse in front of the value you want, you see 3 dots, if you then click on the 3 dots you have the options: Include/Exclude/Extend Column.
If you select extend column, the following will be added to your query:
| extend Name_ = tostring(parse_json(Parameters)[1].Name)
Name_ will be the name of the column.