parse-activity-name-and-id.md

Parse activity name and ID

#project #parse #split

The 2 examples below rely on the fixed structure of the Activity column: -.

The first example uses the parse operator to assign values to 2 new columns: activityID and activityDesc.

SecurityEvent
| take 100
| project Activity 
| parse Activity with activityID " - " activityDesc

This example uses the split operator to create an array of separate values

SecurityEvent
| take 100
| project Activity 
| extend activityArr=split(Activity, " - ") 
| project Activity , activityArr, activityId=activityArr[0]