parse_path()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Parses a file path string and returns a dynamic object that contains the following parts of the path:

• Scheme
• RootPath
• DirectoryPath
• DirectoryName
• Filename
• Extension
• AlternateDataStreamName

In addition to the simple paths with both types of slashes, the function supports paths with:

• Schemas. For example, "file://..."
• Shared paths. For example, "\shareddrive\users..."
• Long paths. For example, "\?\C:...""
• Alternate data streams. For example, "file1.exe:file2.exe"

parse_path(path)

Learn more about syntax conventions.

An object of type dynamic that included the path components as listed above.

datatable(p:string) 
[
    @"C:\temp\file.txt",
    @"temp\file.txt",
    "file://C:/temp/file.txt:some.exe",
    @"\\shared\users\temp\file.txt.gz",
    "/usr/lib/temp/file.txt"
]
| extend path_parts = parse_path(p)

Output