extractPropertyFromWbemPath (Compute)

When To Use

Use extractPropertyFromWbemPath when a WBEM or WMI query returns a reference column — an object path such as \\HOST\root\cimv2:Win32_Account.Domain="CONTOSO",Name="jsmith" — and you need one of its key properties as a plain value. The compute parses the path's key="value" pairs in the selected column and replaces the whole path, in place, with the value of the requested property (quotes removed).

This is typical after querying WMI association classes (Win32_LoggedOnUser, Win32_SessionProcess, …) whose Antecedent/Dependent columns are object paths, often right after a tableJoin with keyType: Wbem.

Syntax

sources:
  loggedOnUsers:
    type: wmi
    namespace: root\cimv2
    query: SELECT Antecedent, Dependent FROM Win32_LoggedOnUser
    computes:
    # Antecedent (column 1) is \\HOST\root\cimv2:Win32_Account.Domain="...",Name="..."
    - type: duplicateColumn
      column: 1
    - type: extractPropertyFromWbemPath
      column: 1
      property: Domain
    - type: extractPropertyFromWbemPath
      column: 2
      property: Name

Properties

If the property is not found in the path, the column value is left as is.

Table Transformation Example

With column: 2 and property: Name:

Recommended Pattern

• To extract two properties from the same path (e.g. Domain and Name), duplicateColumn first, then run one extractPropertyFromWbemPath per copy, as WindowsProcess does.
• Combine with tableJoin and keyType: Wbem when joining association-class results on object-path keys, and extract the human-readable properties only after the join.
• Follow up with keepOnlyMatchingLines or keepColumns once the plain values are available.

Common Mistakes

• Running the compute twice on the same column expecting to get two properties; each run replaces the path with a single value — duplicate the column first.
• Using it on a column that holds a plain value rather than a key="value" object path; without a matching property= pair, the value is left unchanged.
• Counting columns from 0: column is 1-based.
• Property values that themselves contain commas are not supported: the path is split on commas before the key="value" pairs are parsed.

Community Examples

• WindowsProcess^[1]

From WindowsProcess (the only community connector using this compute), included directly from the connector source:

- type: duplicateColumn
  column: 21
- type: extractPropertyFromWbemPath
  column: 21
  property: Domain
- type: extractPropertyFromWbemPath
  column: 22
  property: Name