I have a query that is taken from diagnostic logs output from Azure App Services and pushed into a Log Analytics Workspace.

AppServiceAppLogs
| where TimeGenerated >= now(-1h) and Level == "Error"
| project TimeGenerated , _ResourceId , Source, ResultDescription
| summarize ErrorsLogged = count() by _ResourceId
| order by ErrorsLogged
| render piechart 

When the chart (any chart) renders it displays the correct full _ResourceId table contents, such as...

/subscriptions/00000-000000-000000-00000000/resourcegroups/my-resource-group/providers/microsoft.web/sites/my-webapp

These end up being too long to display. Is there anyway to trim out the /subscriptions/00000-000000-000000-00000000/resourcegroups/my-resource-group/providers/microsoft.web/sites/ in the results?

Thanks in advance

CodePudding user response：

You can try something like:

AppServiceAppLogs
| where TimeGenerated >= now(-1h) and Level == "Error"
| project TimeGenerated, ResourceName=tostring(split(_ResourceId, "/")[-1]), Source, ResultDescription
| summarize ErrorsLogged = count() by ResourceName
| order by ErrorsLogged
| render piechart 

Basically it splits the _ResourceId using "/" as delimiter (which gives you an array) and then gets the last element in that array and aliases it as ResourceName.

References:

• split(): https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/splitfunction
• Retrieving the 'index'-th value from the end of the array is done by arr[-index] (accessing the last value is done using arr[-1] - here's the reference.