Forum Discussion
LodewykV
Oct 23, 2020Copper Contributor
Loop through array in KQL
Hi, I've been exploring parsing and noticed that when parsing xml you get dictionaries and arrays. You can't pass those in functions, but you can pass a var of type dynamic, but then to loop you ...
GaryBushey
Feb 16, 2021Bronze Contributor
LodewykV All of that can be done using tables and either join or union commands. I would recommend looking at the "externdata " and the Watchlist functionality to get external data
LodewykV
Feb 20, 2021Copper Contributor
GaryBusheyHi Gary, thanks for the recommendation. I'm using the externaldata operator to do an api call and am parsing the data using mv-expand and parse_json, although I've got to use the loop functionality in playbooks to be able to do what I want to do.
I'll have a look at watchlists though.