Question 103112 in Azure Question posted in
The official documentation to get you started can be found here.

Azure – How can I get sub value in nested json via KQL?

I try to access nested json in the Kusto query via KQL. But I realized that assignedTo and AssignedTo2 are empty.How can I get sub value in nested json via KQL ?

this is my Kusto query :

requests
| extend prop= parse_json(customDimensions.data) 
| extend AssignedTo = prop.SYNSTA_SynchronizationStatus
| extend AssignedTo2=customDimensions["data"]["SYNSTA_SynchronizationStatus"]
| where  customDimensions['source']=="xxxx"
| project  AssignedTo , AssignedTo2

enter image description here

Tags:

2

Answers


  1. 0

    it looks like you can simply use the coalesce() function.

    for example:

    let default_value = 0;
print input = dynamic({"value1":7,"value2":13})
| project value3 = coalesce(input.value3, 0)

    if you actually need to modify the dynamic object, you can try using the bag_set_key() function

    Login or Signup to reply.
  2. 0

    ut I realized that assignedTo and AssignedTo2 are empty.

    I want Fullname in customDimensions :

    enter image description here

    I have reproduced in my environment and got expected results as below:

    Then used the below query(modified your code):

    requests 
| extend prop= parse_json(customDimensions) 
| extend AssignedTo = prop.FullName
| project AssignedTo

    Output:

    enter image description here

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search