Follow

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use
Contact

Is it possible to rename a column that contains special signs and numbers in microsoft azure in KQL?

I started working with Microsoft’s sentinel one.

I’m working on gathering information from the logs that sentinel is producing.
For better readability, I want to change the names of the columns that I’m projecting, but couldn’t rename a column that contained numbers and special characters.
I’m using KQL to gather the logs from sentinel

AuditLogs
| where OperationName == "Add group" or OperationName == "Delete group"
| where TimeGenerated > ago(20d)
| project TargetResources[0].displayName, OperationName, ActivityDateTime
| project-rename GroupName = TargetResources[0].displayName, Time = ActivityDateTime, Type = OperationName

So renaming the columns: ActivityDateTime & OperationName is working, but I get an error that says "column name expected" when trying to rename the first column. Even though it appear when running that code.

MEDevel.com: Open-source for Healthcare and Education

Collecting and validating open-source software for healthcare, education, enterprise, development, medical imaging, medical records, and digital pathology.

Visit Medevel

Is there a way to rename that column?

>Solution :

TargetResources[0].displayName is an expression, not a column name, so there’s nothing to rename here.

If you want to give this expression a name, you can use the extend operator.

| extend GroupName = TargetResources[0].displayName

project-rename

print TargetResources = dynamic([{"displayName": "Tic"}, {"displayName": "Tac"}, {"displayName": "Toe"}])
| project-rename GroupName = TargetResources[0].displayName

project-rename: expression ” cannot be used as a column name

Fiddle

print TargetResources = dynamic([{"displayName": "Tic"}, {"displayName": "Tac"}, {"displayName": "Toe"}])
| extend GroupName = TargetResources[0].displayName
TargetResources GroupName
[{"displayName":"Tic"},{"displayName":"Tac"},{"displayName":"Toe"}] Tic

Fiddle

Add a comment

Leave a Reply

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use

Discover more from Dev solutions

Subscribe now to keep reading and get access to the full archive.

Continue reading