Substring in appinsight

Question

How can I find a Substring in Microsoft AppInsight Analytics?

I have event with this template name: "FinalStep-Start: 12:11:20.467 | End: 12:11:20.936" I want to separate those two time, and after that compare them with each other.

Answer 1

You can parse the start and end times into their own columns using the "parse" operator:

| parse eventText with * "FinalStep-Start: " start " | End: " end

But because the datetimes are not in a standard supported by analytics I wasn't able to cast them into DateTime for further processing:

range x from 1 to 1 step 1
| extend eventText = "FinalStep-Start: 12:11:20.467 | End: 12:11:20.936"
| parse eventText with * "FinalStep-Start: " start " | End: " end
| extend start_dt = todatetime(start) 
| extend end_dt = todatetime(end)