kql

Topics in the source

• KQL Mastery
• 1. KQL Basics
• Pipe-forward syntax
• Query vs management commands
• 2. Dynamic Type Discipline
• 3. Join Patterns & Pitfalls
• Equality only
• Left/right attribute matching

Try it yourself: All ✅ examples in this skill can be run against the public help cluster: https://help.kusto.windows.net, database Samples (contains StormEvents, SimpleGraphNodes/Edges, nyctaxi, and more). Kusto Query Language (KQL) is a pipe-forward query language for exploring data. It is the native query language for Azure Data Explorer (ADX), Microsoft Fabric Real-Time Intelligence (EventHouse), Azure Monitor Log Analytics, Microsoft Sentinel, and other Microsoft data services. KQL queries are a chain of operators separated by |. Data flows left to right: KQL has two execution planes: | Plane | Starts with | Examples | |-------|-------------|----------| | Query | Table name, let, print, datatable | StormEvents \| where State == "TEXAS" | | Management | .show, .create, .set, .drop, .alter | .show tables, .show table T schema | Management commands can be followed by query operators (the output is tabular), but the entire request runs on the management plane. You cannot start with a query and pipe into a management command. When in doubt: if the first token starts with ., it's a management command. For a full catalog of schema exploration commands, see references/discovery-queries

This is an excerpt. Refer to the complete source and its current requirements.