show on ipadress value in a column

Copper Contributor
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus == 'Can be onboarded'
| join kind=inner (DeviceNetworkInfo | distinct DeviceId, MacAddress, IPAddresses) on DeviceId
| distinct Timestamp, DeviceName, DeviceId, OSPlatform, OSDistribution, OSVersion, ReportId, MacAddress, IPAddresses
the result of IPAddresses column is


i like to have only the value only, in this example:
I have tryied with | extend IP = tostring(todynamic(IPAddresses).IPAddress), but somehow it does not show me the result. How can I do it correct , (i have not mush expirience in this part)

kind regards

1 Reply


| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus == 'Can be onboarded'
| join kind=inner (DeviceNetworkInfo | distinct DeviceId, MacAddress, IPAddresses) on DeviceId
| mvexpand parse_json(IPAddresses)
| extend IP=IPAddresses.IPAddress
| project DeviceName, OnboardingStatus, OSPlatform,OSDistribution,OSVersion, MacAddress, IP
| sort by DeviceName asc

ok, I have found a way , but is there a way to remove the double DeviceName's ? Distinc does not work on IP