Search code examples
kqlazure-log-analyticsazure-sentinel

Azure Kusto Query to trim multiple parts of a string

I'm using a KQL query in Azure to create a Sentinel alert.

I can't workout how to trim a string to show the data between the third instance of the " character and the first instance of (

I've tried to use a trim_start/ trim_end and also a split command but keep getting regex problems.

An example of the string is [ "HOSTNAME", "Test User ([email protected])" ]

I'd like to either extract Test User from the string or HOSTNAME, Test User and [email protected] into separate fields.

Any help or pointers in the right direction would be appreciated

Solution

  • you could use the parse operator.

    for example:

    print input = '[ "HOSTNAME", "Test User ([email protected])" ]'
| parse input with * '"' host_name '"' * '"' user_name ' (' email_address ')' *
    input host_name user_name email_address
    [ "HOSTNAME", "Test User ([email protected])" ] HOSTNAME Test User [email protected]