Merge pull request #28 from CliveW-MSFT/master

Add Extract examples to Scenarios

How to extract the Resource Group ID and subscription from _ResourceId/Queries/ExtractExamples.kql

@@ -0,0 +1,26 @@
+// Author: CliveW-MSFT 
+// Display name: How to extract Subscription or ResourceGroup from _ResourceID
+// Description: Demo on methods to extract data using KQL.  AzureActivity data used as an example.  Three methods are shown to extract the same data.  Key words: Split, Extract and Parse
+// Categories: Azure Monitor
+// Resource types: Azure Monitor
+// Topic: Extract
+
+AzureActivity
+| extend subId =  split(_ResourceId,"/").[2]
+| extend resGr =  split(_ResourceId,"/").[4]
+| project _ResourceId, subId, resGr
+
+AzureActivity
+| parse _ResourceId with * '/subscriptions/' subId '/' *
+| parse _ResourceId with * '/resourcegroups/' resGr '/' *
+| distinct  subId, resGr
+
+AzureActivity
+| extend subId = extract(@"/subscriptions/(.*?)/", 1,_ResourceId)
+| extend resGr = extract(@"/resourcegroups/(.*?)/", 1,_ResourceId)
+| project subId, resGr
+
+
+// Just do a regex lookup  
+AzureActivity
+| where _ResourceId matches regex @"/subscriptions/(.*?)/"

Scenarios/How to extract the Resource Group ID and subscription from _ResourceId/Queries/ExtractExamples.kql

@@ -0,0 +1,57 @@
+<<<<<<< HEAD
+// Author: Microsoft Azure
+// Display name: How to extract Subscription or ResourceGroup from _ResourceID
+// Description: Demo the methods to extract requested data using KQL.  AzureActivity data used as an example.  Three methods are shown to extract the same data.  Key words: Split, Extract and Parse
+// Categories: monitor
+// Resource types: Azure Monitor
+// Solutions: LogManagement
+// Topic: Extract
+
+AzureActivity
+| extend subId =  split(_ResourceId,"/").[2]
+| extend resGr =  split(_ResourceId,"/").[4]
+| project _ResourceId, subId, resGr
+
+AzureActivity
+| parse _ResourceId with * '/subscriptions/' subId '/' *
+| parse _ResourceId with * '/resourcegroups/' resGr '/' *
+| distinct  subId, resGr
+
+AzureActivity
+| extend subId = extract(@"/subscriptions/(.*?)/", 1,_ResourceId)
+| extend resGr = extract(@"/resourcegroups/(.*?)/", 1,_ResourceId)
+| project subId, resGr
+
+
+// Just do a regex lookup  
+AzureActivity
+| where _ResourceId matches regex @"/subscriptions/(.*?)/"
+=======
+// Author: Microsoft 
+// Display name: How to extract Subscription or ResourceGroup from _ResourceID
+// Description: Demo on methods to extract data using KQL.  AzureActivity data used as an example.  There methids are shownm to extract the same data.  Key words: Split, Extract and Parse
+// Categories: monitor
+// Resource types: Azure Monitor
+// Solutions: LogManagement
+// Topic: Extract
+
+AzureActivity
+| extend subId =  split(_ResourceId,"/").[2]
+| extend resGr =  split(_ResourceId,"/").[4]
+| project _ResourceId, subId, resGr
+
+AzureActivity
+| parse _ResourceId with * '/subscriptions/' subId '/' *
+| parse _ResourceId with * '/resourcegroups/' resGr '/' *
+| distinct  subId, resGr
+
+AzureActivity
+| extend subId = extract(@"/subscriptions/(.*?)/", 1,_ResourceId)
+| extend resGr = extract(@"/resourcegroups/(.*?)/", 1,_ResourceId)
+| project subId, resGr
+
+
+// Just do a regex lookup  
+AzureActivity
+| where _ResourceId matches regex @"/subscriptions/(.*?)/"
+>>>>>>> 810726a31d84a47ceee7c2c59b94563d21a2c6eb