extend-context of multiple columns at once

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

extend-context of multiple columns at once

L1 Bithead

Hi all.
I'm struggling a lot to solve a particular issue.
I am performing a Log analytics query which returns 4 columns (named AuthenticationRequirement, ResultType, ExternalUser and TrustedNetwork). The result could result in multiple rows with these 4 columns.

I want to map each of these columns to a separate key, but I don't find a suitable way to do this as they all come scrambled together in an unorganized matter.

This is what the raw-response looks like:

EspenAbildgaard_0-1664871502807.png

 

The optimal result I am looking for, is that each 4 of these columns are mapped to their own separate keys, matching the column names. The applicable row results will have to be stored inside it as well.

 

For example, the two rows with the result "0", which would be "tables.0.rows.0.1" and "tables.0.rows.1.1", should be stored inside / below the key "ResultType". 

 

Does anyone have a smart solution for this?

 

I can get the result I want with extend-context if the query only gives me a single column, but I would rather run a single query than having to divide it into 4 separate queries.

 

The result I get from the task output when I run it in debugger looks like this:

EspenAbildgaard_0-1664872920815.png

 

 

PS: possible outputs for the task looks like this:

EspenAbildgaard_0-1664872384980.png

 

2 REPLIES 2

L3 Networker

We could always try and figure out how to present it in the way you wish in the context, but is the end goal to present it in a table for an analyst or is the context the end goal in and an out of itself?

 

If the end goal is to present the data to an analyst I would recommend using the jsonToTable integration and seeing if that shows the data as you need it. 

 

Let me know if you need further assistance. 

The automation will perform a Kusto query (KQL), in which some data is returned. The desired outcome would be that the data I receive can easily be split so that I can perform a conditional task on them.
For example, the KQL query might return 4 columns, and I would want to extend-context to assign each of them to a particular key, which I then use for a conditional task.

  • 1812 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!