Customizing Parameter Xml field in Log Analytics Query Result

%3CLINGO-SUB%20id%3D%22lingo-sub-3272563%22%20slang%3D%22en-US%22%3ECustomizing%20Parameter%20Xml%20field%20in%20Log%20Analytics%20Query%20Result%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3272563%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3EBased%20on%20requirement%2C%20we%20ran%20the%20following%20Query%20in%20log%20analytics%20workspace%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EEvent%3CBR%20%2F%3E%7C%20where%20EventID%20%3D%3D%207001%3C%2FP%3E%0A%3CP%3EParameterXml%20field%20contains%20the%20value%20in%20XMl%20format%20as%20follows%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3COBJECT%3E%3CPARAM%20%2F%3E3%3CPARAM%20%2F%3E%22Ramesh%22%3C%2FOBJECT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBut%20we%20want%20to%20extract%20only%20the%20user%20name%20from%20ParameterXml%20column%2C%20so%20we%20used%20the%20following%20KQL%3A%3C%2FP%3E%0A%3CP%3EEvent%3CBR%20%2F%3E%7C%20where%20EventID%20%3D%3D%207001%3CBR%20%2F%3E%7C%20extend%20userinfo%3Dparse_xml(ParameterXml)%3CBR%20%2F%3E%7C%20extend%20Param_%20%3D%20tostring(userinfo.Param)%3CBR%20%2F%3E%7C%20project%20userinfo%2CComputer%2CParam_%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBut%20the%20output%20of%20userinfo%20column%20showed%20in%20some%20sort%20of%20simplified%20manner%20as%20below%3CBR%20%2F%3E%7B%22Param%22%3A%22Ramesh%22%7D%3C%2FP%3E%0A%3CP%3EAs%20we%20used%20following%20line%3C%2FP%3E%0A%3CP%3E%7C%20extend%20Param_%3D%20tostring(userinfo.Param)%3C%2FP%3E%0A%3CP%3Ewe%20thought%20of%20getting%20a%20user%20name%20but%2C%3C%2FP%3E%0A%3CP%3EParam_%20field%20also%20displaying%20number%2C%20rather%20than%26nbsp%3B%20username.%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EIt%20doesn't%20met%20our%20requirement%2C%20Suggest%20a%20way%20to%20get%20only%20the%20username%20from%20the%20column.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

Hi,

Based on requirement, we ran the following Query in log analytics workspace:

 

Event
| where EventID == 7001

ParameterXml field contains the value in XMl format as follows:

 

<Param>3</Param><Param>"Ramesh"</Param>

 

But we want to extract only the user name from ParameterXml column, so we used the following KQL:

Event
| where EventID == 7001
| extend userinfo=parse_xml(ParameterXml)
| extend Param_ = tostring(userinfo.Param)
| project userinfo,Computer,Param_

 

But the output of userinfo column showed in some sort of simplified manner as below
{"Param":"Ramesh"}

As we used following line

| extend Param_= tostring(userinfo.Param)

we thought of getting a user name but,

Param_ field also displaying number, rather than  username.


It doesn't met our requirement, Suggest a way to get only the username from the column.

0 Replies