parse_csv()

Applies to: ✅ Azure Data ExplorerAzure MonitorMicrosoft Sentinel

Splits a given string representing a single record of comma-separated values and returns a string array with these values.

Syntax

parse_csv(csv_text)

Learn more about syntax conventions.

Parameters

Name Type Required Description
csv_text string ✔️ A single record of comma-separated values.

Note

  • Embedded line feeds, commas, and quotes may be escaped using the double quotation mark ('"').
  • This function doesn't support multiple records per row (only the first record is taken).

Returns

A string array that contains the split values.

Examples

Filter by count of values in record

Count the conference sessions with more than three participants.

ConferenceSessions
| where array_length(parse_csv(participants)) > 3
| distinct *

Output

sessionid ... participants
CON-PRT157 ... Guy Reginiano, Guy Yehudy, Pankaj Suri, Saeed Copty
BRK3099 ... Yoni Leibowitz, Eric Fleischman, Robert Pack, Avner Aharoni

Use escaping quotes

print result=parse_csv('aa,"b,b,b",cc,"Escaping quotes: ""Title""","line1\nline2"')

Output

result
[
"aa",
"b,b,b",
"cc",
"Escaping quotes: "Title"",
"line1\nline2"
]

CSV with multiple records

Only the first record is taken since this function doesn't support multiple records.

print result_multi_record=parse_csv('record1,a,b,c\nrecord2,x,y,z')

Output

result_multi_record
[
"record1",
"a",
"b",
"c"
]