{"record":{"id":"40bccb69a5f7eeb6","repo":"wtfutil/wtf","slug":"query-returned-no-data-tables-s","errorCode":null,"errorMessage":"query returned no data tables: %s","messagePattern":"query returned no data tables: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/azurelogs/query.go","lineNumber":85,"sourceCode":"\n\tres, err := client.QueryWorkspace(\n\t\tcontext.Background(),\n\t\tqf.WorkspaceID,\n\t\tazquery.Body{\n\t\t\tQuery: to.Ptr(qf.Query),\n\t\t},\n\t\tnil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to execute query on workspace %s: %w\", qf.WorkspaceID, err)\n\t}\n\n\tif res.Error != nil {\n\t\treturn nil, res.Error\n\t}\n\n\tswitch len(res.Tables) {\n\tcase 0:\n\t\treturn nil, fmt.Errorf(\"query returned no data tables: %s\", qf.Query)\n\tcase 1:\n\t\tif len(res.Tables[0].Columns) == 0 {\n\t\t\treturn nil, fmt.Errorf(\"query returned table with no columns: %s\", qf.Query)\n\t\t}\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"query returned %d tables, expected 1: %s\", len(res.Tables), qf.Query)\n\t}\n\n\t// Process each row of data\n\tfor _, row := range res.Tables[0].Rows {\n\t\tvar r TableRow\n\n\t\tfor _, field := range row {\n\t\t\tif field == nil {\n\t\t\t\tr = append(r, \"\")\n\t\t\t\tcontinue\n\t\t\t}\n","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/wtfutil/wtf/blob/bb838c1ccb0f0f3223690df44afdec663d622881/modules/azurelogs/query.go#L67-L103","documentation":"After a successful query execution, RunQuery inspects res.Tables. If the Azure Log Analytics response contains zero tables, the library throws this error because the rendered output always expects exactly one table. Note the %s verb interpolates the KQL query text, not an error string.","triggerScenarios":"RunQuery or fetchDataAsync receiving a valid response whose Tables slice is empty — typically when the KQL query produces no result set (e.g. a filter that matches nothing combined with certain operators) or the API returns an empty body.","commonSituations":"Queries with a WHERE clause matching no rows in the lookback window, querying a table that doesn't exist in the workspace but not erroring, or time-range filters excluding all data.","solutions":["Loosen the KQL query's filters or extend the time range so it returns at least one row","Verify the target table exists in the workspace (AzureActivity, SigninLogs, etc.)","Run the query in the Azure Portal Log Analytics editor to see what it returns","Add defensive handling in the caller for empty result sets if empty results are expected"],"exampleFix":"// before\nlet filtered = AzureActivity | where TimeGenerated > ago(1h) | where OperationName == \"Nonexistent\"\n// after\nlet filtered = AzureActivity | where TimeGenerated > ago(24h)  // widen window / relax filters","handlingStrategy":"validation","validationCode":"// probe the workspace/table before the real query\nres, err := client.Query(ctx, workspaceID, azquery.Body{Query: to.Ptr(tableName + \" | count\")}, nil)\nif err != nil || len(res.Tables) == 0 || res.Tables[0].Rows[0][0].(float64) == 0 {\n    return errors.New(\"table empty or missing; adjust filters or time range\")\n}","typeGuard":null,"tryCatchPattern":"tables, err := RunQuery(sess)\nif err != nil {\n    if strings.Contains(err.Error(), \"no data tables\") {\n        log.Println(\"query matched no rows; relaxing time range\")\n        return nil // treat as empty result if acceptable\n    }\n    return err\n}","preventionTips":["Prefer queries with `| summarize count()` fallbacks over bare filters","Set generous time ranges (ago(24h)) in scheduled queries","Verify table names exist in the workspace before deploying the config"],"tags":["azure","log-analytics","kql","empty-result"],"backgroundTag":"empty-query-result","analyzedSha":"bb838c1ccb0f0f3223690df44afdec663d622881","analyzedAt":"2026-09-03T17:02:45.030Z","contentChangedAt":"2026-09-03T17:02:45.030Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}