How to parse CSV data in Data Collection Rule?

Yusuf KUYRUKÇU 20 Reputation points
2024-08-06T23:24:13.02+00:00

Hello,

I can parse CSV data with this KQL in LAW:

parse_csv(RawData)

However, when I use it in the Transform section of the Data Collection Rule, I get the following error:

Update Error - Error occurred while compiling query in query: SemanticError:0x00000009 at 1:28 : Runtime scalar function provider not found for function: parse_csv

Transform:

source | extend CSVFields = parse_csv(RawData)

I already tried this: split(RawData, ',')

If a data is in double quotes and contains a comma, it continues to split, so this is against the structure of CSV.

How can I parse a CSV file in DCR?

Best Regards.

Azure
Azure
A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.
1,020 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,141 questions
0 comments No comments
{count} votes

Accepted answer
  1. Stanislav Zhelyazkov 24,216 Reputation points MVP
    2024-08-07T06:00:04.8533333+00:00

    Hi,

    parse_csv is not one of the supported functions for transformation.

    If you could may be pass the data in other format like json you could use parse_json.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.


0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.