Skip to content

Commit 384ca56

Browse files
author
Ken Lawson
committed
Improved Acrolinx score
1 parent 731eef2 commit 384ca56

File tree

2 files changed

+6
-6
lines changed

2 files changed

+6
-6
lines changed

learn-pr/wwl-sci/work-with-data-kusto-query-language/includes/2-extract-data-from-unstructured-string-fields.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
Security log data is often contained in unstructured string fields and requires parsing to extract data. There are multiple ways of pulling information from string fields in KQL. The two primary operators used are extract and parse.
1+
Security log data is often contained in unstructured string fields and requires parsing to extract data. There are multiple ways of pulling information from string fields in KQL. The two primary operators used are extract and parse.
22

3-
## extract
3+
## Extract
44

55
Extract gets a match for a regular expression from a text string. You may optionally convert the extracted substring to the indicated type.
66

@@ -37,9 +37,9 @@ SecurityEvent
3737
3838
```
3939

40-
## parse
40+
## Parse
4141

42-
Parse evaluates a string expression and parses its value into one or more calculated columns. The computed columns will have nulls for unsuccessfully parsed strings.
42+
Parse evaluates a string expression and parses its value into one or more calculated columns. The computed columns have nulls for unsuccessfully parsed strings.
4343

4444
Syntax
4545

@@ -57,7 +57,7 @@ Arguments
5757

5858
- flags: Flags to be used in regex mode like U (Ungreedy), m (multi-line mode), s (match new line \n), i (case-insensitive) in RE2 flags.
5959

60-
- relaxed: StringConstant is a regular string value and the match is relaxed. All string delimiters should appear in the parsed string, but extended columns may partially match the required types. Extended columns that didn't match the required types will get the value null.
60+
- relaxed: StringConstant is a regular string value and the match is relaxed. All string delimiters should appear in the parsed string, but extended columns may partially match the required types. Extended columns that didn't match the required types get the value null.
6161

6262
- Expression: An expression that evaluates to a string.
6363

learn-pr/wwl-sci/work-with-data-kusto-query-language/index.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ uid: learn.wwl.work-with-data-kql
33
metadata:
44
title: Work with data in Microsoft Sentinel using Kusto Query Language
55
description: "Work with data in Microsoft Sentinel using Kusto Query Language"
6-
ms.date: 08/04/2022
6+
ms.date: 02/28/2025
77
author: wwlpublish
88
ms.author: kelawson
99
ms.topic: module

0 commit comments

Comments
 (0)