Morning momentum

KQL Mystery

2 min read

Alternatively: Where's Sherlock Holmes when you need him

· · ─ ·✶· ─ · ·

I am learning KQL and for practice I have a dummy KQL cluster. In this cluster there’s a table called Errors. And that table has a column called errorMessage. The only value in that column is "Database timeout".

Data is ingested into this table inline via

.ingest inline into table Errors <|
datetime(2026-04-25 00:01:00), "r3", "Database timeout"
datetime(2026-04-25 00:02:00), "r4", "Database timeout"
datetime(2026-04-25 00:04:00), "r6", "Database timeout"
datetime(2026-04-25 00:06:00), "r8", "Database timeout"

Now since I am learning, I wanted to test the in operator. So I tried doing,

Errors
| where errorMessage in ("Database timeout")

This doesnt make much sense to do but I expect all the records from Errors where the errorMessage column has the value exactly as "Database timeout" to show up. But it doesnt work when I run this query. It gives me no records back.

So I try something more explicit,

Errors
| where errorMessage == "Database timeout"

Same. No records back. What?

Something is clearly wrong here and I start debugging. I try,

Errors
| project errorMessage, strlen(errorMessage)

And I get back the length as 19. But "Database timeout" including the double quotes is only 18. There’s an extra invisible character somewhere. Perhaps a space?

Lets visualize it.

Errors
| project msg = strcat("|", errorMessage, "|")

This gives me `| “Database timeout”|. Aha. So there is a leading space in that string. But how?

Answer: Its because of how I did the inline ingestion.

Something like,

.ingest inline into table Errors <|
datetime(2026-04-25 00:01:00), "r3", "Database timeout"

looks clean, but .ingest inline behaves more like CSV parsing than code parsing.

So this part: , "Database timeout" includes a space after the comma, And Kusto interprets it literally as:

" Database timeout"

The solution is to just do the below, ie, without the spaces before comma:

.ingest inline into table Errors <|
datetime(2026-04-25 00:01:00),"r3","Database timeout"

Some more debugging. We can do,

Errors
| extend c0 = substring(errorMessage, 0, 1),
         c1 = substring(errorMessage, 1, 1),
         c2 = substring(errorMessage, 2, 1)

And we can see that the first character is ” ” (space) therefore confirming the leading space.

· · ─ ·✶· ─ · ·

Graph View