Azure Log Analytics - expanding a property

0
votes

I'm fairly new to using log analytics and not very familiar with the KQL language yet for queries.

I'm trying to do a query that will get the objectID value out of what appears to be a multi-valued property from the query. When I do a standard search to list the results in a table one of the columns is Properties, and the objectID is within that property column.

Not sure how to go about doing this so the results just show the objectID.

enter image description here

1
azure-log-analytics
please try to add project Properties.ObjectId in your query, and see if the ObjectId can be shown. And also you'd better add your query in your question. - Ivan Yang

1 Answers

1
votes

It would have helped to see your initial kusto query included in the question.

Nevertheless, you can use the project operator of KQL to extract the ObjectId as:

T
| ..<the rest of your query>..
| project Properties.ObjectId

where T is the table you are trying to query.

Here are some resources for you to get started with Kusto Query Language: