What causes "query returned table with no columns: %s" in wtfutil/wtf?

Review the KQL projection: ensure `| project` lists at least one column and columns are named

query returned table with no columns: %s

Error message

query returned table with no columns: %s

What it means

RunQuery throws this when the single returned table has a Columns slice of length zero. Column metadata is required to map each row's values to output fields, so a column-less table cannot be processed. The KQL query text is included in the message for debugging.

Source

Thrown at modules/azurelogs/query.go:88

		qf.WorkspaceID,
		azquery.Body{
			Query: to.Ptr(qf.Query),
		},
		nil)
	if err != nil {
		return nil, fmt.Errorf("failed to execute query on workspace %s: %w", qf.WorkspaceID, err)
	}

	if res.Error != nil {
		return nil, res.Error
	}

	switch len(res.Tables) {
	case 0:
		return nil, fmt.Errorf("query returned no data tables: %s", qf.Query)
	case 1:
		if len(res.Tables[0].Columns) == 0 {
			return nil, fmt.Errorf("query returned table with no columns: %s", qf.Query)
		}
	default:
		return nil, fmt.Errorf("query returned %d tables, expected 1: %s", len(res.Tables), qf.Query)
	}

	// Process each row of data
	for _, row := range res.Tables[0].Rows {
		var r TableRow

		for _, field := range row {
			if field == nil {
				r = append(r, "")
				continue
			}

			// Convert all data types to string representation
			switch v := field.(type) {
			case string:

View on GitHub (pinned to bb838c1ccb)

Solutions

Review the KQL projection: ensure `| project` lists at least one column and columns are named
Re-run the query in the Azure Portal editor to confirm it returns a proper schema
Check for schema issues on custom tables (run ` TableName | getschema`)
If a proxy is in front of the API, verify it is not truncating the response body

Example fix

// before
MyTable | project  // no columns listed
// after
MyTable | project TimeGenerated, OperationName, ResultSignature

Defensive patterns

Strategy: validation

Validate before calling

// ensure the query defines explicit named columns
if !strings.Contains(strings.ToLower(qf.Query), "project ") && !strings.Contains(strings.ToLower(qf.Query), "extend ") {
    return errors.New("query should use | project with named columns")
}

Try / catch

tables, err := RunQuery(sess)
if err != nil {
    if strings.Contains(err.Error(), "no columns") {
        return fmt.Errorf("KQL returns no schema; fix projection: %w", err)
    }
    return err
}

Prevention

Always end queries with an explicit `| project col1, col2`
Run `TableName | getschema` to confirm the table schema
Validate KQL in the portal editor before adding to query files

When it happens

Trigger: RunQuery or fetchDataAsync receiving a response with exactly one table but zero columns — usually an API-side anomaly or a degenerate query (e.g. a query returning an empty projection like `| project` with no columns, or certain scalar-only queries).

Common situations: Malformed KQL projection clauses, queries against custom tables with broken schemas, or proxy/gateway responses that strip the table schema.

Related errors

AI-assisted analysis of wtfutil/wtf@bb838c1ccb (2026-09-03). Data as JSON: /api/errors/3d74b12f32e1487b. Report an issue: GitHub.