XQL filter o365 attachments

[FabioFerreira]

Hi,

I am trying to filter o365 attachments without success, could you help pls

sample

[
  {
    "@odata.type": "#microsoft.graph.fileAttachment",
    "@odata.mediaContentType": "image/jpeg",
    "id": "AAMkADEzYjJhMzM1LTY0ODctNGUxOS05ZDc5LTQ2MWM3NzFmMTRjOABGAAAAAABaN8y0q3IrQ6fyDga7Z5M3BwBvSXHDOoi0TJ5-l2B-i9PgAAAAAAEMAADyHfSb-T8wR5Fak3aFlfaBAACPB9PLAAABEgAQAE8kDtOZeABMuRd54VyYgc4=",
 },
  {
    "@odata.type": "#microsoft.graph.fileAttachment",
    "@odata.mediaContentType": "image/png",
    "id": "AAMkADEzYjJhMzM1LTY0ODctNGUxOS05ZDc5LTQ2MWM3NzFmMTRjOABGAAAAAABaN8y0q3IrQ6fyDga7Z5M3BwBvSXHDOoi0TJ5-l2B-i9PgAAAAAAEMAADyHfSb-T8wR5Fak3aFlfaBAACPB9PLAAABEgAQAI8pDv4IgY1BhJhVm9_2_E8=",
}
]

 XQL

dataset = msft_o365_emails_raw |
| fields attachments as attach
| alter attachid = json_extract_scalar_array(to_json_string(arrayindex(attach, 0)) , "$.id")

Regards,

Fabio Ferreira

[PiyushKohli · Accepted solution]

Hi @FabioFerreira 

Thank you for writing to live community!

Assuming type of the field which contains above value is json, could you try this below:

| alter attachment_id = arraymap(json_extract_array(to_json_string(fieldname),"$."),json_extract_scalar("@element","$.id"))
| arrayexpand attachment_id

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards.

[SuporteDVT]

Hi @PiyushKohli 

It worked!

Thanks a lot 🙂

Regards,