- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
10-04-2022 01:26 AM - edited 10-04-2022 01:42 AM
Hi all.
I'm struggling a lot to solve a particular issue.
I am performing a Log analytics query which returns 4 columns (named AuthenticationRequirement, ResultType, ExternalUser and TrustedNetwork). The result could result in multiple rows with these 4 columns.
I want to map each of these columns to a separate key, but I don't find a suitable way to do this as they all come scrambled together in an unorganized matter.
This is what the raw-response looks like:
The optimal result I am looking for, is that each 4 of these columns are mapped to their own separate keys, matching the column names. The applicable row results will have to be stored inside it as well.
For example, the two rows with the result "0", which would be "tables.0.rows.0.1" and "tables.0.rows.1.1", should be stored inside / below the key "ResultType".
Does anyone have a smart solution for this?
I can get the result I want with extend-context if the query only gives me a single column, but I would rather run a single query than having to divide it into 4 separate queries.
The result I get from the task output when I run it in debugger looks like this:
PS: possible outputs for the task looks like this:
02-13-2023 11:45 AM
We could always try and figure out how to present it in the way you wish in the context, but is the end goal to present it in a table for an analyst or is the context the end goal in and an out of itself?
If the end goal is to present the data to an analyst I would recommend using the jsonToTable integration and seeing if that shows the data as you need it.
Let me know if you need further assistance.
02-13-2023 11:14 PM
The automation will perform a Kusto query (KQL), in which some data is returned. The desired outcome would be that the data I receive can easily be split so that I can perform a conditional task on them.
For example, the KQL query might return 4 columns, and I would want to extend-context to assign each of them to a particular key, which I then use for a conditional task.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!