KQL: Unpacking array into columns - kql

Question

I have the following records:
Message = User: Value1 \r\nComponent: Value2\r\nResult description: Value3\r\nName: Value4
Message = Event type: ValueA\r\nApplication: ValueB\r\nApplication\\Path: ValueC\r\nUser: ValueD
Using | extend Message = split(Message, "\\r\\n") I get the following results:
Message = ["User:Value1", "Component:Value2", "Result description:Value3", "Name:value4"]
Message = [Event type:ValueA", "Application:ValueB", "Path:ValueC","User: ValueD"]
I would like to use the "keys" here as column names and the "values" to populate them as such:
User |Component| ResultDescription| Name | EventType | Application | Path
_________________________________________________________________________
Value1|Value2 | Value3 |Value4| | |
ValueD| | | | ValueA | ValueB | ValueC
I've tried using both mv_expand and bag_unpack but the most I've successfully been able to do looks like this:
Message
__________
["User:value1]
["Component:value2]
["ResultDescription:value3]
and so on.
How can I do this?

Answer 1

It'd be inefficient, but you could try this:
use extract_all() to extract the key-value pairs from the input message
expand the pairs using mv-apply, and create a property bag out of them using summarize make_bag()
use evaluate bag_unpack() to unpack the property bag into columns
[Note: you may need to adjust the regular expression used in the example below to match the contents of your keys/values]
datatable(s:string)
[
'Message = User: Value1 \r\nComponent: Value2\r\nResult description: Value3\r\nName: Value4',
'Message = Event type: ValueA\r\nApplication: ValueB\r\nApplication\\Path: ValueC\r\nUser: ValueD',
]
| mv-apply e = extract_all(#"(\w+): (\w+)", dynamic([1,2]), s) on (
project p = pack(tostring(e[0]), e[1])
| summarize b = make_bag(p)
)
| evaluate bag_unpack(b)
s
Application
Component
description
Name
Path
type
User
Message = User: Value1 Component: Value2Result description: Value3Name: Value4
Value2
Value3
Value4
Value1
Message = Event type: ValueAApplication: ValueBApplication\Path: ValueCUser: ValueD
ValueB
ValueC
ValueA
ValueD