Skip to content

Instantly share code, notes, and snippets.

@LeeHolmes

LeeHolmes/PowerShell Script Block Merge in Kusto

Created March 9, 2022 19:40
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save LeeHolmes/c5f9be64788a139073744abba5ab4352 to your computer and use it in GitHub Desktop.
Save LeeHolmes/c5f9be64788a139073744abba5ab4352 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
PowerShell Script Block Merge in Kusto
Event
| where EventID == "4104"
| extend ParsedEvent = parse_xml(strcat("<root>", ParameterXml, "</root>"))
| extend MessageNumber = tolong(ParsedEvent.root.Param[0])
| extend MessageTotal = tolong(ParsedEvent.root.Param[1])
| extend ScriptBlockElement = iff(
strlen(tostring(ParsedEvent.root.Param[2]["#text"])) > 0,
ParsedEvent.root.Param[2]["#text"],
ParsedEvent.root.Param[2])
| extend ScriptBlockId = tostring(ParsedEvent.root.Param[3])
| extend Path = ParsedEvent.root.Param[4]
| order by MessageNumber asc
| summarize TimeGenerated = min(TimeGenerated),
Path = take_any(Path), ScriptBlockText = strcat_array(make_list(tostring(ScriptBlockElement)), "") by ScriptBlockId
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment