Table count from custom log

Hi alchem_rj.,

You can tweak the regular expression, using the operator $ which means end of match.

In your case:

extend table_name = (extract ("(abc_8val_yy$)", 0, RawData))

Reference for regular expressions supported in Kusto: https://github.com/google/re2/wiki/Syntax

Rafi

Hi Rafi_Rabo,

Is it possible to fetch the exact matching string from Rawdata using "extract" operator? or any other command?

Hi alchem_rj , 

This behavior is expected since the string "abc_8val_yy" is a sub-string of "abc_8val_yy_vw".

Follow the extract operator documentation for more details: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/extractfunction

Rafi

Hi Rafi_Rabo 

Thanks a lot for your help.

I also notice that if I use a similar table name in the extend operator am getting same result.

extend table_name = (extract ("(abc_8val_yy)", 0, RawData))

The output (count of table name) of above query and below query is same

extend table_name = (extract ("(abc_8val_yy_vw)", 0, RawData))

Hi alchem_rj ,

Try running the following: Go to Log Analytics and run query

I tweaked the regexp to: 

abc_[0-9]+val_[0-9A-Za-z_]+

If you still have issues, please share the data and query you are trying to run.

Rafi

Hi Rafi_Rabo ,

When I use the Regex you have provided I am getting all the value in the RawData along with the table name. I am not able to filter the exact table name from the RawData.

Hi alchem_rj ,

The following should work:  abc_[0-9]+val_.+

Here is a link to the regular expression syntax supported by Kusto:   https://github.com/google/re2/wiki/Syntax 

Rafi

Hi Rafi_Rabo,

Do we have RegExp similar to below?

1. abc_[0-9]val_* (all string or word )after this?

Expected table names

abc_1val_dd

abc_3val_xx

abc_2val_extra_cc

Thanks