KQL Search

Query Details

MV Epand Example

Query

AuditLogs
| mv-expand TargetResources
| extend modifiedProperties = parse_json(TargetResources).modifiedProperties
| mv-expand modifiedProperties
| extend DisplayName = tostring(parse_json(modifiedProperties).displayName), GroupName = tostring(parse_json(modifiedProperties).newValue)
| project DisplayName, GroupName, TargetResources

Explanation

This query retrieves data from the AuditLogs table. It expands the TargetResources column and extracts the modifiedProperties as JSON. It then expands the modifiedProperties column and extracts the displayName and newValue values. Finally, it projects the DisplayName, GroupName, and TargetResources columns in the output.

Details

Rod Trent profile picture

Rod Trent

Released: January 19, 2022

Tables

AuditLogs

Keywords

AuditLogsmv-expandTargetResourcesextendmodifiedPropertiesparse_jsonDisplayNametostringGroupNamenewValueproject

Operators

mv-expandextendparse_jsontostringproject

Actions

GitHub