Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

String functions within playbooks

Brass Contributor



Have the following string that I need to tidy up:


"hostname","{\r\n \"LastLog\": [\r\n \"2024-06-25T16:15:35.751991Z\"\r\n ]\r\n}"


so it can have


hostname   2024-06-25 16:15:35


I have attempted to combine replace statements with no luck...


Any ideas..


Many thanks,



1 Reply



Hello, you probably should look at extract() or even parse() - assuming this is KQL within the playbooks?

Here is a simple example to get you going


let txt = '"hostname","{\r\n \"LastLog\": [\r\n \"2024-06-25T16:15:35.751991Z\"\r\n ]\r\n}"';
print txt
| parse txt with *'"' HostName_ '"' *
| parse txt with *'[\r\n \"' Date_ '\"\r\n ]' *