extract()

Syntax

extract(regex, captureGroup, source [, typeLiteral])

Arguments

• regex: A regular expression.
• captureGroup: A positive int constant indicating the capture group to extract. 0 stands for the entire match, 1 for the value matched by the first '('parenthesis')' in the regular expression, 2 or more for subsequent parentheses.
• source: A string to search.
• typeLiteral: An optional type literal (e.g., typeof(long)). If provided, the extracted substring is converted to this type.

Returns

If regex finds a match in source: the substring matched against the indicated capture group captureGroup, optionally converted to typeLiteral.

If there's no match, or the type conversion fails: null.

Examples

The following example shws the extracted value of the cid using a CrowdStrike Falcon Insight data source

events    
    | project original_time, data_source_name, payload
    //--- Search for the last 5 minutes of data
    | where original_time > ago(5d)    
    //--- USER Criteria Here    
    | extend extracted_Value =extract("\"cid\":(.*?),", 1, payload, typeof(string))
    | take 1

Note : payload partially shown.