How to parse json array in kusto query language - azure-log-analytics

Question

How to parse json array in kusto query language.
I have an output column which is having value in JSON array format as shown below. I Need to parse it to get values in form of two columns.
{"count": 14
"value": [
{
"Total_Record_Count": 16608,
"date": "2021-03-01T00:00:00Z"
},
{
"Total_Record_Count": 27254,
"date": "2021-02-24T00:00:00Z"
},
{
"Total_Record_Count": 6,
"date": "2021-02-01T00:00:00Z"
},
{
"Total_Record_Count": 26964,
"date": "2021-01-15T00:00:00Z"
},
{
"Total_Record_Count": 134516,
"date": "2020-12-18T00:00:00Z"
},
{
"Total_Record_Count": 27345,
"date": "2020-12-16T00:00:00Z"
},
{
"Total_Record_Count": 521,
"date": "2020-12-01T00:00:00Z"
},
{
"Total_Record_Count": 4,
"date": "2020-11-02T00:00:00Z"
},
{
"Total_Record_Count": 6,
"date": "2020-10-01T00:00:00Z"
},
{
"Total_Record_Count": 1,
"date": "2020-09-01T00:00:00Z"
},
{
"Total_Record_Count": 3,
"date": "2020-08-03T00:00:00Z"
},
{
"Total_Record_Count": 18,
"date": "2020-07-01T00:00:00Z"
},
{
"Total_Record_Count": 18754,
"date": "2020-06-16T00:00:00Z"
},
{
"Total_Record_Count": 4451898,
"date": "2020-06-08T00:00:00Z"
}
]}
How can I achieve it using output column name instead of using full json array.

Answer 1

Please see example below that uses mv-expand operator for breaking array into rows.
https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/mvexpandoperator
print d = dynamic(
{"count": 14,
"value": [
{
"Total_Record_Count": 16608,
"date": "2021-03-01T00:00:00Z"
},
{
"Total_Record_Count": 27254,
"date": "2021-02-24T00:00:00Z"
},
{
"Total_Record_Count": 6,
"date": "2021-02-01T00:00:00Z"
},
{
"Total_Record_Count": 26964,
"date": "2021-01-15T00:00:00Z"
},
{
"Total_Record_Count": 134516,
"date": "2020-12-18T00:00:00Z"
},
{
"Total_Record_Count": 27345,
"date": "2020-12-16T00:00:00Z"
},
{
"Total_Record_Count": 521,
"date": "2020-12-01T00:00:00Z"
},
{
"Total_Record_Count": 4,
"date": "2020-11-02T00:00:00Z"
},
{
"Total_Record_Count": 6,
"date": "2020-10-01T00:00:00Z"
},
{
"Total_Record_Count": 1,
"date": "2020-09-01T00:00:00Z"
},
{
"Total_Record_Count": 3,
"date": "2020-08-03T00:00:00Z"
},
{
"Total_Record_Count": 18,
"date": "2020-07-01T00:00:00Z"
},
{
"Total_Record_Count": 18754,
"date": "2020-06-16T00:00:00Z"
},
{
"Total_Record_Count": 4451898,
"date": "2020-06-08T00:00:00Z"
}
]})
| project Value = d.['value']
| mv-expand Value
| project Count = tolong(Value.['Total_Record_Count']), Date = todatetime(Value.['date'])
Count
Date
4451898
2020-06-08 00:00:00.0000000
18754
2020-06-16 00:00:00.0000000
18
2020-07-01 00:00:00.0000000
3
2020-08-03 00:00:00.0000000
1
2020-09-01 00:00:00.0000000
6
2020-10-01 00:00:00.0000000
4
2020-11-02 00:00:00.0000000
521
2020-12-01 00:00:00.0000000
27345
2020-12-16 00:00:00.0000000
134516
2020-12-18 00:00:00.0000000
26964
2021-01-15 00:00:00.0000000
6
2021-02-01 00:00:00.0000000
27254
2021-02-24 00:00:00.0000000
16608
2021-03-01 00:00:00.0000000