Lab 2 - Simple Parsing, Grouping, and Filtering

Learn basic operators to parse and group your search results.

1. Search CloudTrail logs to identify the top 10 IP addresses for the US West Region.

_sourceCategory=Labs/AWS/CloudTrail

// You can use the json operator on json-formatted logs and then filter on the us-west-1 region using where

| json "awsRegion"

| where awsregion="us-west-1"

// You can use a mix of parsing operators in the same query and using count group the ip addresses 

| parse regex "(?<ip_address>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

| count by ip_address

| top 10 ip_address by _count

2. You can chart your results by choosing any of the available charting options. Below we chose the circle graph by clicking on the circle graph icon.

3. To see the details as above, you can either zoom out, or just click on the gray arrow just above the Add to Dashboard.