loggingkqlazure-log-analyticsazure-sentinelazure-log-analytics-workspace

How to read data from log analytics Custom table

I'm trying to send data across log analytics workspaces using logic app for this purpose i have used send data action that creates a custom log table.

The problem that when i wanted to use this table in KQL query i cannot access to some rows example : when i want to get Setting name from data_s row i get this error enter image description here

Row Definition

enter image description here

Does anyone know how to access these rows ?

Solution

  • if Data_s is of type string but is a valid JSON payload, you'll need to first use parse_json() on it to be able to access properties in it.

    for example:

    datatable(Data_s: string) ['{"SettingName":"PurgeRuns"}']
| extend Data_d = parse_json(Data_s)
| where Data_d.SettingName in ("PurgeRuns","PurgeArtifacts")