Skip to content

Expand docs - How to extract fields with varying names (pattern) #24

@lowell80

Description

@lowell80

Add an example to the docs that highlights this search pattern:

 | jmespath output=NewDisplayName "ExtendedProperties[?Name=='targetUpdatedProperties'].Value | from_string(@[0]) | [?ends_with(Name,'.DisplayName')].NewValue"

Thanks to @jpapasadora

MS O365 Management.

Search something like: sourcetype=ms:o365:management member (group OR role)

Metadata

Metadata

Assignees

Labels

docsDocumentation

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions