0

I need to parse out the users names from multiple alerts within azure.

If i use the following extend i can get the data from '0'

| extend Name = tostring(parse_json(Entities)[0].Name)

but sometimes the data is at 6 or 9 ect, i can simple add a new line with "name2 = ...." but id need to know exactly how many entities there may be and this number might unmanageable.

Is there a way i can KQL to parse through all entities and create a new column for each .name entities

Erik Oppedijk
  • 3,496
  • 4
  • 31
  • 42
Jack Antony Park
  • 95
  • 10

1 Answers1

2

you can use mv-expand or mv-apply

Yoni L.
  • 22,627
  • 2
  • 29
  • 48