kql

# KQL Mastery ## 1. KQL Basics Kusto Query Language (KQL) is a pipe-forward query language for exploring data. It is the native query language for Azure Data Explorer (ADX), Microsoft Fabric Real-Time Intelligence (EventHouse), Azure Monitor Log Analytics, Microsoft Sentinel, and other Microsoft data services. ### Pipe-forward syntax KQL queries are a chain of operators separated by `|`. Data flows left to right: ```kql StormEvents // start with a table | where State == "TEXAS" // filter rows | summarize count() by EventType // aggregate | top 5 by count_ desc // limit results ``` ### Query vs management commands KQL has two execution planes: | Plane | Starts with | Examples | |-------|-------------|----------| | **Query** | Table name, `let`, `print`, `datatable` | `StormEvents \| where State == "TEXAS"` | | **Management** | `.show`, `.create`, `.set`, `.drop`, `.alter` | `.show tables`, `.show table T schema` | Management commands cannot be piped into query operators: ```kql // ❌ WRONG — .show is management, | project is query .show tables | project TableName // ✅ RIGHT — run management and query separately // Step 1: .show tables // Step 2: MyTable | take 5 ``` When in doubt: if the first token starts with `.`, it's a management command. ## 2. Dynamic Type Discipline KQL's `dynamic` type is flexible but strict in certain contexts. A common mistake is using a dynamic column in `summarize by`, `order by`, or...