Issue with Kusto query with parse-where

Question

Hi team,

I am trying to do something like:

let Traces = datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, isPreviousLockTime=True",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, isPreviousLockTime=False",
];
Traces  
| parse-where EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices: long ", sliceNumber=" sliceNumber: long ", lockTime=" lockTime: date ", releaseTime=" releaseTime: date ", isPreviousLockTime=" isPreviousLockTime: bool ""
| project
    resourceName,
    totalSlices,
    sliceNumber,
    lockTime,
    releaseTime,
    isPreviousLockTime

but I am getting the error: parse-where: failed to analyze the pattern: Empty string literal cannot be used as delimiter

If I modify my data stream like:

let Traces = datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, isPreviousLockTime=True)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, isPreviousLockTime=False)",
];
Traces  
| parse-where EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices: long ", sliceNumber=" sliceNumber: long ", lockTime=" lockTime: date ", releaseTime=" releaseTime: date ", isPreviousLockTime=" isPreviousLockTime: bool ")"  
| project
    resourceName,
    totalSlices,
    sliceNumber,
    lockTime,
    releaseTime,
    isPreviousLockTime

Then it works. Could you please suggest of this is a known issue or is there is any workaround for this?

Answer 1

The error message you're seeing, "parse-where: failed to analyze the pattern: Empty string literal cannot be used as delimiter", occurs when the parse-where operator encounters an empty string literal ("") used as a delimiter.

In your case, the issue is that you're using an empty string literal as the delimiter in your parse-where statement. Specifically, you're using "" as the delimiter in the following expression:

parse-where EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices: long ", sliceNumber=" sliceNumber: long ", lockTime=" lockTime: date ", releaseTime=" releaseTime: date ", isPreviousLockTime=" isPreviousLockTime: bool ""

This is causing the error. Instead, you should use a different delimiter that does not include an empty string literal. For example, you could use a delimiter like | instead:

parse-where EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices: long ", sliceNumber=" sliceNumber: long ", lockTime=" lockTime: date ", releaseTime=" releaseTime: date ", isPreviousLockTime=" isPreviousLockTime: bool "|"

This should resolve the issue you're encountering.