XQL : Need help with json_extract

[Antony_Chan]

Dear Community,

I was trying to use the json_extract to extract the value of "RuleActions" and have no success so far.

Sample data:

{"RuleOperation":"AddMailboxRule","RuleId":"0","RuleState":"Enabled, ExitAfterExecution","RuleCondition":"{(SubString IgnoreCase(SubjectProperty)=ABC Communication)}","RuleName":"ABC Communication","RuleProvider":"RuleOrganizer","RuleActions":"[{"ActionType":"Move","DestinationFolderId":"LgAAAAAugyiuv11hR6F4h74ucfwGAASDFVCEqNKZSaN2wuruT03jAAC7WAXhAAAB","FolderIsInThisStore":"True"}]"}

The value is always turned out to be "[{" instead of "[{"ActionType":"Move","DestinationFolderId":"LgAAAAAugyiuv11hR6F4h74ucfwGAASDFVCEqNKZSaN2wuruT03jAAC7WAXhAAAB","FolderIsInThisStore":"True"}]"

The syntax that I'm using is 

RuleActions = json_extract(OperationProperties, "$.RuleActions")

FYI, I've tried json_extract_scalar, json_extract_array, json_extract_scalar_array and have no success.

Thank you in advance!

Cortex XDR 

[nsinghvirk]

Hello @Antony_Chan 

Thanks for reaching out on Live Community!

Please try following query format if you are looking for Action type value or replace it with whichever field you want.

RuleActions = json_extract(OperationProperties, "$.RuleActions.ActionType")

Please click Accept as Solution to acknowledge that the answer to your question has been provided.