Azure Queries: Difference between revisions
Jump to navigation
Jump to search
Created page with "=Get Data from subfield <source> SecurityIoTRawEvent | where RawEventName == "ConnectionCreate" | project RemoteAddress=extractjson("$.RemoteAddress", EventDetails, typeof..." |
No edit summary |
||
| Line 1: | Line 1: | ||
=Get Data from subfield | =Get Data from subfield= | ||
<source> | <source> | ||
SecurityIoTRawEvent | where RawEventName == "ConnectionCreate" | project RemoteAddress=extractjson("$.RemoteAddress", EventDetails, typeof(string)) | SecurityIoTRawEvent | where RawEventName == "ConnectionCreate" | project RemoteAddress=extractjson("$.RemoteAddress", EventDetails, typeof(string)) | ||
</source> | </source> | ||
Latest revision as of 20:23, 23 October 2019
Get Data from subfield
SecurityIoTRawEvent | where RawEventName == "ConnectionCreate" | project RemoteAddress=extractjson("$.RemoteAddress", EventDetails, typeof(string))