How do I iterate through array in Kusto? - azure-data-explorer

Question

I need to iterate through managed data disks in Azure Resource Graph Explorer (https://preview.portal.azure.com/). My query is below but it returns JSON array, I need to extract name of disk and type of storage account which is being used (sample JSON return is below). So I'd like to see on screen grouping by machine name, disk name and then storage account type. My current query is below but obviously it does not work due to return of JSON
where type =~ 'Microsoft.Compute/virtualmachines' |
extend disks = properties.storageProfile.dataDisks |
project name, disks
Same JSON output
[
{
"name": "COMP02_DDisk1",
"createOption": "Attach",
"diskSizeGB": 400,
"managedDisk": {
"id": "/subscriptions/5f5c5be9-77d4db790171/resourceGroups/BRAZILSOUTHDB/providers/Microsoft.Compute/disks/COMP02_DDisk1",
"storageAccountType": "Premium_LRS"
},
"caching": "None",
"toBeDetached": false,
"lun": 0,
"writeAcceleratorEnabled": false
},
{
"name": "COMP02_DDisk2",
"createOption": "Attach",
"diskSizeGB": 400,
"managedDisk": {
"id": "/subscriptions/5f5c5be9-77d4db790171/resourceGroups/BRAZILSOUTHDB/providers/Microsoft.Compute/disks/COMP02_DDisk2",
"storageAccountType": "Premium_LRS"
},
"caching": "None",
"toBeDetached": false,
"lun": 1,
"writeAcceleratorEnabled": false
}
]

Answer 1

in such cases, it's usually helpful to use mv-expand to expand the array and then apply the dynamic-property accessors foreach record.
https://learn.microsoft.com/en-us/azure/kusto/query/mvexpandoperator
example:
print d = dynamic([
{
"name": "COMP02_DDisk1",
"createOption": "Attach",
"diskSizeGB": 400,
"managedDisk": {
"id": "/subscriptions/5f5c5be9-77d4db790171/resourceGroups/BRAZILSOUTHDB/providers/Microsoft.Compute/disks/COMP02_DDisk1",
"storageAccountType": "Premium_LRS"
},
"caching": "None",
"toBeDetached": false,
"lun": 0,
"writeAcceleratorEnabled": false
},
{
"name": "COMP02_DDisk2",
"createOption": "Attach",
"diskSizeGB": 400,
"managedDisk": {
"id": "/subscriptions/5f5c5be9-77d4db790171/resourceGroups/BRAZILSOUTHDB/providers/Microsoft.Compute/disks/COMP02_DDisk2",
"storageAccountType": "Premium_LRS"
},
"caching": "None",
"toBeDetached": false,
"lun": 1,
"writeAcceleratorEnabled": false
}
])
| mv-expand d
| project d.name, d.managedDisk.storageAccountType
which will output:
| d_name | d_managedDisk_storageAccountType |
|---------------|----------------------------------|
| COMP02_DDisk1 | Premium_LRS |
| COMP02_DDisk2 | Premium_LRS |

Answer 2

Hope you are doing good .
You can try this way also, First i found networksecuritygroups from entire collection and later filtered defaultSecurityRules which is again an array.
After collecting it using mvexpand in local variable rules you should be able to fetch the desired after applying.
where type =~ "microsoft.network/networksecuritygroups"
| mvexpand rules = properties.defaultSecurityRules
| where rules.properties.destinationAddressPrefix =~ "*"
You can also refer given below link and wish it will help you also.