Search code examples
azurekqlkusto-explorerappinsights

How can I get sub value in nested json via KQL?

I try to access nested json in the Kusto query via KQL. But I realized that assignedTo and AssignedTo2 are empty.How can I get sub value in nested json via KQL ?

this is my Kusto query :

requests
| extend prop= parse_json(customDimensions.data) 
| extend AssignedTo = prop.SYNSTA_SynchronizationStatus
| extend AssignedTo2=customDimensions["data"]["SYNSTA_SynchronizationStatus"]
| where  customDimensions['source']=="xxxx"
| project  AssignedTo , AssignedTo2

enter image description here

Solution

  • ut I realized that assignedTo and AssignedTo2 are empty.

    I want Fullname in customDimensions :

    enter image description here

    I have reproduced in my environment and got expected results as below:

    Then used the below query(modified your code):

    requests 
| extend prop= parse_json(customDimensions) 
| extend AssignedTo = prop.FullName
| project AssignedTo

    Output:

    enter image description here