I have linked the following log itno azure log anlytic environment via customer log

2023-01-24 07:58:30[X:MoveCarddataShare_Start]
2023-01-24 07:58:30[X;MoveCarddataShare_FileTomove:SA\Dispatch\)
2023-01-24 07:58:30[X;MoveCarddataShare_FileCountTomove:2)
2023-01-24 07:58:32[X;MoveCarddataShare_FileTomove:Styled and Co\Dispatch\)
2023-01-24 07:58:32[X;MoveCarddataShare_FileCountTomove:2)

I want to now the value of X (which is the client) and then the action and then the result

THe following code works

let temp =
    ShelSA_cardMovment_CL
    | parse RawData with * "[" C
    | parse RawData with * ";" A
    | parse RawData with * "^" R
    | extend dt = substring(RawData,0,19)
                ,Client = split(C,";",0)
                ,Action = split(A,"^",0)
                ,Re = R;
temp
|extend Result= replace_string(tostring(Re),')','')

But all resulting columns have "[ ]" around the output the replace will remove it but it seems ungainly

["ShellSA"]
["MoveCarddataShare_FileTomove"]
Symon\Dispatch\)

Also, I wondered if this is the best way

This is the CV output I want

CodePudding user response：

I'm guessing this is what you are looking for

datatable(RawData:string)
[
    @"2023-01-24 07:58:30[X:MoveCarddataShare_Start]"
   ,@"2023-01-24 07:58:30[X;MoveCarddataShare_FileTomove:SA\Dispatch\)"
   ,@"2023-01-24 07:58:30[X;MoveCarddataShare_FileCountTomove:2)"
   ,@"2023-01-24 07:58:32[X;MoveCarddataShare_FileTomove:Styled and Co\Dispatch\)"
   ,@"2023-01-24 07:58:32[X;MoveCarddataShare_FileCountTomove:2)"
]
| parse kind=regex flags=U RawData with Timestamp:datetime @"\[" Client "[;:]" Action @"[]:]" Result @"\)?$"

Fiddle