0

I'm working in Kusto Query Language and I would like to display not everything from the selected string.

My string is 'Execution fail against sql server. Please contact SQL Server team if you need further support. Sql error number: 50000. Error Message: Invalid length parameter passed to the LEFT or SUBSTRING function.'

But I would like to just display from 'Error Message: Invalid length parameter passed to the LEFT or SUBSTRING function.'

Could anybody help me with this problem? I don't know which function I need to use in KQL. Thanks!

An answer on my question ;)

AndreasB
  • 11
  • 1

2 Answers2

0

you could use the parse operator. for example:

print input = 'Execution fail against sql server. Please contact SQL Server team if you need further support. Sql error number: 50000. Error Message: Invalid length parameter passed to the LEFT or SUBSTRING function.'
| parse input with * "Error Message:" error_message
| extend error_message = strcat("Error Message:", error_message)
input error_message
Execution fail against sql server. Please contact SQL Server team if you need further support. Sql error number: 50000. Error Message: Invalid length parameter passed to the LEFT or SUBSTRING function. Error Message: Invalid length parameter passed to the LEFT or SUBSTRING function.
Yoni L.
  • 22,627
  • 2
  • 29
  • 48
0
print MyString = 'Execution fail against sql server. Please contact SQL Server team if you need further support. Sql error number: 50000. Error Message: Invalid length parameter passed to the LEFT or SUBSTRING function.'
| parse MyString with * "Error Message:" ErrorMessage
| project ErrorMessage
ErrorMessage
Invalid length parameter passed to the LEFT or SUBSTRING function.

Fiddle

If needed, concatenate "Error Message:" to the start of the message

project strcat("Error Message:", ErrorMessage)
David דודו Markovitz
  • 42,900
  • 6
  • 64
  • 88