String Manipulation in KQL

Question

How can you Manipulate the output of a string in KQL? For example I have a query to find loggedon users for a specific group of devices and this is an output I received. I would only want Username to show in the output.

DeviceInfo
|where  DeviceID== "hksjdfhksdf"
|project DeviceName, LoggedOnUsers

[{"UserName":"djlskjfdl","DomainName":"kfjgldkjfg","Sid":"jldfkgjfd2"}]

Answer 1

If your column is of type dynamic, then you can simply extract the first element in the array, and then extract the value of the UserName key, like this:

let str = dynamic([{"UserName":"djlskjfdl","DomainName":"kfjgldkjfg","Sid":"jldfkgjfd2"}]);
print str[0].UserName

Output:

print_0
djlskjfdl

If your column is of type string, you can make it dynamic by using todynamic().