Extract following word after match word in Kusto

Question

Kusto uses the re2 library: https://github.com/google/re2/wiki/Syntax, as mentioned here: https://learn.microsoft.com/en-us/azure/kusto/query/re2 so apparently lookarounds is not supported.

Sample String:Some sentence. Some word Some word ServiceInstanceId:78d61d2f-6df9-4ba4-a192-0713d3cd8a82.1234 not found. , ErrorCode:2 Some sentences. Some sentences.Some sentences.

Is it possible to extract 78d61d2f-6df9-4ba4-a192-0713d3cd8a82 from the above string in Kusto. Need all characters after "ServiceInstanceId:" until next space.

Answer 1

You can use parse:

let MyTable = datatable(s:string) [
    "Sample String:Some sentence. Some word Some word ServiceInstanceId:78d61d2f-6df9-4ba4-a192-0713d3cd8a82.1234 not found. , ErrorCode:2 Some sentences. Some sentences.Some sentences."
];
MyTable
| parse s with * "ServiceInstanceId:" ServiceInstanceId " " *

Result:

s	ServiceInstanceId
Sample String:Some sentence. Some word Some word ServiceInstanceId:78d61d2f-6df9-4ba4-a192-0713d3cd8a82.1234 not found. , ErrorCode:2 Some sentences. Some sentences.Some sentences.	78d61d2f-6df9-4ba4-a192-0713d3cd8a82.1234

Note: you asked to extract until the next space, so the answer should be "78d61d2f-6df9-4ba4-a192-0713d3cd8a82.1234" and not just "78d61d2f-6df9-4ba4-a192-0713d3cd8a82".