如何在 kql 中将 system.string 数据类型解压缩为扁平字符串

Question

架构显示字段是“system.string”并且它具有可变数量的元素，就像列表的列表。我想做的是将其转换为普通字符串并将其存储在一个字段中。只是 tostring() 不削减它。这就像我必须解压然后连接。我怎样才能做到这一点？您可以使用 Tags[0]、Tags[1]... 引用每个元素，但索引的数量是可变的。

示例：如何将 MoreData 展开为扁平字符串？

datatable(Date:datetime, Event:string, MoreData:dynamic) [
datetime(1910-06-11), "Born", dynamic(["value5", "value6"]),
datetime(1930-01-01), "Enters Ecole Navale", dynamic(["value5", "value6"]),
datetime(1953-01-01), "Published first book", dynamic(["value5", "value6"]),
datetime(1997-06-25), "Died", dynamic(["value5", "value6"]),
]

假设您想将“value5”、“value6”的结果生成为字符串？

Answer 1

datatable(Date:datetime, Event:string, MoreData:dynamic) [
datetime(1910-06-11), "Born", dynamic(["value5", "value6"]),
datetime(1930-01-01), "Enters Ecole Navale", dynamic(["value5", "value6"]),
datetime(1953-01-01), "Published first book", dynamic(["value5", "value6"]),
datetime(1997-06-25), "Died", dynamic(["value5", "value6"]),
]
| extend result = array_strcat(MoreData,',')

Date	Event	MoreData	result
1910-06-11T00:00:00Z	Born	["value5","value6"]	value5,value6
1930-01-01T00:00:00Z	Enters Ecole Navale	["value5","value6"]	value5,value6
1953-01-01T00:00:00Z	Published first book	["value5","value6"]	value5,value6
1997-06-25T00:00:00Z	Died	["value5","value6"]	value5,value6

Fiddle

如何在 kql 中将 system.string 数据类型解压缩为扁平字符串

how to unpack a system.string data type into a flat string in kql

kql

azure-sentinel