parse_csv()
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Splits a given string representing a single record of comma-separated values and returns a string array with these values.
Syntax
parse_csv(csv_text)
Learn more about syntax conventions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| csv_text | string |
✔️ | A single record of comma-separated values. |
Note
- Embedded line feeds, commas, and quotes may be escaped using the double quotation mark ('"').
- This function doesn't support multiple records per row (only the first record is taken).
Returns
A string array that contains the split values.
Examples
Filter by count of values in record
Count the conference sessions with more than three participants.
ConferenceSessions
| where array_length(parse_csv(participants)) > 3
| distinct *
Output
| sessionid | ... | participants |
|---|---|---|
| CON-PRT157 | ... | Guy Reginiano, Guy Yehudy, Pankaj Suri, Saeed Copty |
| BRK3099 | ... | Yoni Leibowitz, Eric Fleischman, Robert Pack, Avner Aharoni |
Use escaping quotes
print result=parse_csv('aa,"b,b,b",cc,"Escaping quotes: ""Title""","line1\nline2"')
Output
| result |
|---|
| [ "aa", "b,b,b", "cc", "Escaping quotes: "Title"", "line1\nline2" ] |
CSV with multiple records
Only the first record is taken since this function doesn't support multiple records.
print result_multi_record=parse_csv('record1,a,b,c\nrecord2,x,y,z')
Output
| result_multi_record |
|---|
| [ "record1", "a", "b", "c" ] |