1

I'm working with Powershell, querying Azure Log analytics with the LogAnalyticsQuery module using Invoke-LogAnalyticsQuery.

I have the results

{
    "tables": [
        {
            "name": "PrimaryResult",
            "columns": [
                {"name": "Computer","type": "string"},
                {"name": "TimeGenerated","type": "datetime"},
                {"name": "AggregatedValue","type": "real"
                }
            ],
            "rows": [
                ["VPN-Server","2018-02-20T07:30:00Z",5.083333333333333],
                ["SARMAD-SurfacePro4","2018-02-20T07:30:00Z",14.598250052664012],
                ["VPN-Server","2018-02-20T07:00:00Z",4.9523809523809526],
                ["SARMAD-SurfacePro4","2018-02-20T07:00:00Z",12.104500129109331],
                ["SARMAD-SurfacePro4","2018-02-20T08:00:00Z",20.936097813082174],
                ["VPN-Server","2018-02-20T08:00:00Z",4.245614035087719]
            ]
        }
    ]
}

From the sample above, how I can use powershell to convert it to something like this?:

Reportname, Computer, TimeGenerated, AggregatedValue

Manual Value, JsonValue, JsonValue, JsonValue

2 Answers 2

2

You can use convertfrom-json and can finally use export-csv to export:

$a='{"tables":[{"name":"PrimaryResult","columns":[{"name":"Computer","type":"string"},{"name":"TimeGenerated","type":"datetime"},{"name":"AggregatedValue","type":"real"}],"rows":[["VPN-Server","2018-02-20T07:30:00Z",5.083333333333333],["SARMAD-SurfacePro4","2018-02-20T07:30:00Z",14.598250052664012],["VPN-Server","2018-02-20T07:00:00Z",4.9523809523809526],["SARMAD-SurfacePro4","2018-02-20T07:00:00Z",12.104500129109331],["SARMAD-SurfacePro4","2018-02-20T08:00:00Z",20.936097813082174],["VPN-Server","2018-02-20T08:00:00Z",4.245614035087719]]}]}'
($a | ConvertFrom-Json).tables.columns.name

Hope it helps.

Sign up to request clarification or add additional context in comments.

3 Comments

@Data-base: Acceptance would be appreciable.
one more question what about the rows? I get then in one line like 1,2,3,1,2,3, is there away to split them them?
Yes even you can use -Split "," to split it or you can directly use the string method $object.split(',')
1

You can do it similar to this:

function Get-Tables
{
    param([Parameter(ValueFromPipeline=$true)]$Json)

    process
    {
        foreach ($table in ($Json | ConvertFrom-Json).tables)
        {
            foreach ($row in $table.rows)
            {
                $result = New-Object PSObject
                $columnIndex = 0

                foreach ($column in $table.columns)
                {
                    Add-Member -InputObject $result -MemberType NoteProperty -Name $column.Name -Value ($row[$columnIndex++])
                }

                $result
            }
        }
    }
}

$json | Get-Tables | Export-Csv

Where $json is string variable with value from the question example.

$json = '{  "tables": [   ...  ] }'

3 Comments

getteing error ConvertFrom-Json : Invalid JSON primitive: . At line:7 char:37 + foreach ($table in ($Json | ConvertFrom-Json).tables) + ~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [ConvertFrom-Json], ArgumentException + FullyQualifiedErrorId : System.ArgumentException,Microsoft.PowerShell.Commands.ConvertFromJsonCommand
what about if it was Json and not a string? the data is the results of the Invoke-LogAnalyticsQuery, then I guess I need to remove the ConvertFrom-Json
I need to use $results.Response.Content when I run $results = Invoke-LogAnalyticsQuery and the result is a string ... now it works :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.