How to parse /Date(xxxx)/ in KQL? – Kql

by
Ali Hasan
azure-active-directory azure-powershell datetime kql

Quick Fix: The given answer uses the parse command to extract the timestamp value from the StartTime column, which is in the format of '/Date(xxxx)/'. The extracted timestamp value is then converted to a datetime value using the time_milliseconds_todatetime function and stored in a new column named ActualRequiredTime. Finally, the query projects only the ActualRequiredTime column.

The Problem:

You have a JSON file with timestamps in the format /Date(1680994874000)/. You want to parse these timestamps into a usable DateTime format in Kusto Query Language (KQL) without resorting to custom code.

Q&A

Is there a built-in way to parse /Date(1680994874000)/ in KQL?

Yes, you can use the parse command to extract the date from the string.

How can I use parse command to extract date from /Date(1680994874000)/ string?

You can use the following syntax: parse StartTime with * "/Date(" StartTime1 ")/"

Video Explanation:

The following video, titled "How to Use the Year, Month, & Day Functions to Get Parts of a Date ...", provides additional insights and in-depth exploration related to the topics discussed in this post.

Play video

In this Microsoft Access tutorial, I'm going to teach you how to get the various components of any valid date field using the Year, Month, ...