parse_csv

This page explains how to use the parse_csv function in APL.

The parse_csv function splits a comma-separated values (CSV) string into an array of strings. Use this function to parse CSV-formatted log entries, configuration values, or any comma-delimited data into individual values for analysis.

Usage

Syntax

APL

parse_csv(csv_text)

Parameters

Name	Type	Required	Description
csv_text	string	Yes	A string containing comma-separated values to parse.

Returns

Returns a string array containing the individual values from the CSV string. Properly handles quoted values and escaped characters.

Use case examples

Parse comma-separated status codes or error types from log messages.

Query

APLRun in Playground

['sample-http-logs']
| extend status_list = parse_csv('200,201,204,304')
| extend is_success = status in (status_list)
| summarize request_count = count() by is_success, status
| sort by request_count desc
| limit 10

Output

is_success	status	request_count
true	200	8765
false	404	2341
false	500	1234
true	304	987

This query parses a CSV list of success status codes and categorizes requests accordingly.

Parse comma-separated service lists from trace attributes or configuration.

Query

APLRun in Playground

['otel-demo-traces']
| extend service_list = parse_csv('frontend,checkout,cart')
| extend is_monitored = ['service.name'] in (service_list)
| summarize span_count = count() by ['service.name'], is_monitored
| sort by span_count desc
| limit 10

Output

service.name	is_monitored	span_count
frontend	true	4532
checkout	true	3421
cart	true	2987
product-catalog	false	2341

This query parses a CSV list of monitored services and identifies which services are included in the monitoring scope.

Parse comma-separated allowlists or blocklists for security rule evaluation.

Query

APLRun in Playground

['sample-http-logs']
| extend blocked_ips = parse_csv('192.168.1.100,10.0.0.25,172.16.0.50')
| extend simulated_ip = '192.168.1.100'
| extend is_blocked = simulated_ip in (blocked_ips)
| where is_blocked
| summarize blocked_attempts = count() by status, ['geo.country']
| sort by blocked_attempts desc
| limit 10

Output

status	geo.country	blocked_attempts
403	Unknown	234
401	Russia	123

This query parses a CSV blocklist and identifies requests from blocked IP addresses for security monitoring.

split: Splits strings by any delimiter. Use this when working with non-CSV delimiters or when quote handling isn't needed.
parse_json: Parses JSON strings into dynamic objects. Use this when working with JSON arrays rather than CSV.
strcat_delim: Concatenates strings with delimiters. Use this to create CSV strings from individual values.
extract_all: Extracts multiple regex matches. Use this for more complex parsing patterns beyond CSV.

parse_csv

Usage

Syntax

Parameters

Returns

Use case examples

List of related functions

Other query languages