Matt Zorich • 5/15/2023

Have a JSON headache in KQL? Try mv-expand or mv-apply

This technical article addresses the challenge of querying multi-value JSON data, specifically arrays, in Kusto Query Language (KQL). It uses Azure AD sign-in logs and Conditional Access policies as a practical example, demonstrating why static array indexing fails when data order changes and introduces the mv-expand and mv-apply operators as robust solutions for parsing and analyzing dynamic nested JSON structures in a security/IT operations context.

0 comments

#json #data transformation #Azure Ad