show on ipadress value in a column

Occasional Contributor
DeviceInfo
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus == 'Can be onboarded'
| join kind=inner (DeviceNetworkInfo | distinct DeviceId, MacAddress, IPAddresses) on DeviceId
| distinct Timestamp, DeviceName, DeviceId, OSPlatform, OSDistribution, OSVersion, ReportId, MacAddress, IPAddresses
 
the result of IPAddresses column is

[{"IPAddress":"10.14.14.16","SubnetPrefix":null,"AddressType":"Private"}]

i like to have only the value only, in this example: 10.14.14.16
I have tryied with | extend IP = tostring(todynamic(IPAddresses).IPAddress), but somehow it does not show me the result. How can I do it correct , (i have not mush expirience in this part)

kind regards
Steven


1 Reply

@quinzy 

DeviceInfo
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus == 'Can be onboarded'
| join kind=inner (DeviceNetworkInfo | distinct DeviceId, MacAddress, IPAddresses) on DeviceId
| mvexpand parse_json(IPAddresses)
| extend IP=IPAddresses.IPAddress
| project DeviceName, OnboardingStatus, OSPlatform,OSDistribution,OSVersion, MacAddress, IP
| sort by DeviceName asc

ok, I have found a way , but is there a way to remove the double DeviceName's ? Distinc does not work on IP