Advance your Data & AI career with 50 days of live learning, dataviz contests, hands-on challenges, study groups & certifications and more!
Get registeredGet Fabric Certified for FREE during Fabric Data Days. Don't miss your chance! Learn more
I have a table (CaseData) with a column that contains a complex and variable text string, but within this string is potentially a key standard "phrase" from a list of "string" in another table (Strings).
e.g. text to be searched
[INFORMATIONAL 20230222-OfficeActivity-SharePointFileOperation via previously unseen IPs
| Case Data | 
| Microsoft 365 Defender has detected a security threat Review this incident. [Microsoft 365] Microsoft 365 Defender has detected a security threat in your environment View incident details:  | 
| Defender ATP Endpoint Device Isolation. Endpoint has been Isolated from the Network.  | 
| Defender ATP Endpoint Device Isolation. Endpoint has been Isolated from the Network.  | 
| Defender ATP Endpoint Device Isolation. Endpoint has been Isolated from the Network.  | 
| High severity alert: Suspicious URL clicked on Alert notification email. [Microsoft 365] Suspicious URL clicked was detected by Microsoft Defender for Endpoint on  | 
| High severity alert: Suspicious URL opened in web browser Alert notification email. [Microsoft 365] Suspicious URL opened in web browser was detected by Microso  | 
| High severity alert: Suspicious URL opened in web browser Alert notification email. [Microsoft 365] Suspicious URL opened in web browser was detected by Microso  | 
| High severity alert: Suspicious URL clicked on Alert notification email. [Microsoft 365] Suspicious URL clicked was detected by Microsoft Defender for Endpoint on  | 
| Microsoft 365 Defender has detected a security threat Review this incident. [Microsoft 365] Microsoft 365 Defender has detected a security threat in your environment View incident details:  | 
| LOW (P3)20230407-AzureADIP-Atypical travel- At 15:54 on 07/04/2023 an alert "AzureADIP - Atypical travel" has been generated with the following i  | 
| INFORMATIONAL (P4)20230314-OfficeActivity-SharePointFileOperation via previously unseen IPs- At 06:14 on 14/0  | 
The text string I am looking for would be
SharepointFileOperation
| String | String Group | 
| Defender has detected a security threat | Security threat | 
| Endpoint Device Isolation. | Device Isolated | 
| Suspicious URL clicked on | Suspicious URL | 
| Suspicious URL opened | Suspicious URL | 
| Atypical travel | Location anomaly | 
| SharePointFileOperation | Sharepoint | 
If found I would want to return is the second column in the Strings table, "StringGroup" associated with the text string I was looking for.
Solved! Go to Solution.
Create a measure column in your CaseData table as:
Proud to be a Super User!
Create a measure column in your CaseData table as:
Proud to be a Super User!
Advance your Data & AI career with 50 days of live learning, contests, hands-on challenges, study groups & certifications and more!
Check out the October 2025 Power BI update to learn about new features.
            | User | Count | 
|---|---|
| 8 | |
| 5 | |
| 5 | |
| 4 | |
| 3 | 
| User | Count | 
|---|---|
| 24 | |
| 11 | |
| 10 | |
| 9 | |
| 8 |