skip to Main Content

I’m working in Kusto Query Language and I would like to display not everything from the selected string.

My string is ‘Execution fail against sql server. Please contact SQL Server team if you need further support. Sql error number: 50000. Error Message: Invalid length parameter passed to the LEFT or
SUBSTRING function.’

But I would like to just display from ‘Error Message: Invalid length parameter passed to the LEFT or
SUBSTRING function.’

Could anybody help me with this problem? I don’t know which function I need to use in KQL.
Thanks!

An answer on my question 😉

2

Answers


  1. you could use the parse operator. for example:

    print input = 'Execution fail against sql server. Please contact SQL Server team if you need further support. Sql error number: 50000. Error Message: Invalid length parameter passed to the LEFT or SUBSTRING function.'
    | parse input with * "Error Message:" error_message
    | extend error_message = strcat("Error Message:", error_message)
    
    input error_message
    Execution fail against sql server. Please contact SQL Server team if you need further support. Sql error number: 50000. Error Message: Invalid length parameter passed to the LEFT or SUBSTRING function. Error Message: Invalid length parameter passed to the LEFT or SUBSTRING function.
    Login or Signup to reply.
  2. print MyString = 'Execution fail against sql server. Please contact SQL Server team if you need further support. Sql error number: 50000. Error Message: Invalid length parameter passed to the LEFT or SUBSTRING function.'
    | parse MyString with * "Error Message:" ErrorMessage
    | project ErrorMessage
    
    ErrorMessage
    Invalid length parameter passed to the LEFT or SUBSTRING function.

    Fiddle

    If needed, concatenate "Error Message:" to the start of the message

    project strcat("Error Message:", ErrorMessage)
    
    Login or Signup to reply.
Please signup or login to give your own answer.
Back To Top
Search