Query Details

MV Epand Example

Query

AuditLogs
| mv-expand TargetResources
| extend modifiedProperties = parse_json(TargetResources).modifiedProperties
| mv-expand modifiedProperties
| extend DisplayName = tostring(parse_json(modifiedProperties).displayName), GroupName = tostring(parse_json(modifiedProperties).newValue)
| project DisplayName, GroupName, TargetResources

Explanation

This query retrieves data from the AuditLogs table. It expands the TargetResources column and extracts the modifiedProperties as JSON. It then expands the modifiedProperties column and extracts the displayName and newValue values. Finally, it projects the DisplayName, GroupName, and TargetResources columns in the output.