kql
KQL language expertise for writing correct, efficient Kusto Query Language queries. Covers syntax gotchas, join patterns, dynamic types, datetime pitfalls, regex patterns, serialization, memory management, result-size discipline, and advanced functions (geo, vector, graph). USE THIS SKILL whenever writing, debugging, or reviewing KQL queries — even simple ones — because the gotchas section prevents the most common errors that waste tool calls and cause expensive retry cascades. Trigger on: KQL, Kusto, ADX, Azure Data Explorer, Fabric Real-Time Intelligence, EventHouse, Log Analytics, log analysis, data exploration, time series, anomaly detection, summarize, where clause, join, extend, project, let statement, parse operator, extract function, any mention of pipe-forward query syntax.
原文 · 译文未通过检查适用对象：软件开发与测试。自动收录 · 待核查。
原作者说明节选
从固定版本的 SKILL.md 提取，保留原文语言。以下内容属于作者说明，本站尚未验证安装、兼容或运行结果。
查看英文原文
原文涵盖的主题
- KQL Mastery
- 1. KQL Basics
- Pipe-forward syntax
- Query vs management commands
- 2. Dynamic Type Discipline
- 3. Join Patterns & Pitfalls
- Equality only
- Left/right attribute matching
Try it yourself: All ✅ examples in this skill can be run against the public help cluster: https://help.kusto.windows.net, database Samples (contains StormEvents, SimpleGraphNodes/Edges, nyctaxi, and more). Kusto Query Language (KQL) is a pipe-forward query language for exploring data. It is the native query language for Azure Data Explorer (ADX), Microsoft Fabric Real-Time Intelligence (EventHouse), Azure Monitor Log Analytics, Microsoft Sentinel, and other Microsoft data services. KQL queries are a chain of operators separated by |. Data flows left to right: KQL has two execution planes: | Plane | Starts with | Examples | |-------|-------------|----------| | Query | Table name, let, print, datatable | StormEvents \| where State == "TEXAS" | | Management | .show, .create, .set, .drop, .alter | .show tables, .show table T schema | Management commands can be followed by query operators (the output is tabular), but the entire request runs on the management plane. You cannot start with a query and pipe into a management command. When in doubt: if the first token starts with ., it's a management command. For a full catalog of schema exploration commands, see references/discovery-queries
这里只展示节选，请以完整原文和当前要求为准。
- 来源仓库
- microsoft/skills
- 源文件
- .github/skills/kql/SKILL.md
- 固定版本
- 18e05b845d43e869b5701d796abce6e9a49e57db
来源与内容状态
本条为自动发现的元数据，尚未完成人工文档核查；适用性与运行结果待核查。
原作者：Microsoft Skills · 原作者仓库元数据。文档核查：未核查。最近来源检查：2026-11-10T00:00:24.947Z。
分类由名称、说明与路径规则生成，分类不代表已核实适配。
许可与权利归属
MIT。第三方内容及版权归原作者，使用条件以原文为准。
许可原文 ↗本站没有因同步、复制或用户自报成功而将资源标为运行验证通过。
限制与注意事项
- 元数据收录不代表本站已经安装、适配、实测或进行安全审查。