Writing Queries with Kusto Query Language (KQL)

⚠️ This article has moved to my website.

You can read the latest version here:
👉 https://henriquesd.com/articles/writing-queries-with-kusto-query-language-kql

Below is a short preview of the article.

Kusto Query Language (KQL) is a powerful tool to explore data, designed to query structured, semi-structured, and unstructured data. It has a user-friendly syntax and supports filterings, aggregations, joins, and creating visualizations like charts and graphs, making it ideal for querying logs, metrics and telemetry. In this article, I present how to write queries using KQL.

KQL allows users to retrieve insights from various data sources, and it is a read-only language, so it can not be used to modify or delete data. It is used for monitoring, troubleshooting, and performing analytics, and is supported in a series of Microsoft Products, such as Azure Data Explorer, Microsoft Fabric, Azure Monitor, Microsoft Sentinel, Azure Resource Graph, Microsoft Defender XDR and Configuration Manager (if you want to know what each of these tools are, please check the official Microsoft documentation here).

Playground Environment — Azure Data Explorer (ADX)

Microsoft provides a free playground in Azure Data Explorer that can be used to learn how to work with KQL, for that you only need to have an Azure subscription.

For the next examples in this article, I will be using Azure Data Explorer to demonstrate various queries. However, as mentioned before, many other tools also support KQL.

To create your test environment, do the following:

• Sign in to the Azure Data Explorer web UI
• Then click on “Query” > “Add” > “Connection”:

• Then type help in the “Connection URI” and click on “Add”:

• Then click on the Samples database, and we can then write some queries to query data from the StormEvents table from the Storm_Events table folder:

Query flow

A query begins by specifying the data source, which serves as the foundation by defining the dataset to be analyzed. From this starting point, various operators and commands can be applied in sequence, to filter, transform, and summarize the data, this is indicated visually by the use of a pipe character (|), and you can also combine multiple operations in the same query. Below is a visual representation from Microsoft illustrating this process:

source: https://learn.microsoft.com/en-us/training/modules/explore-fundamentals-kql/4-kql-query-structure

The tabular input is the beginning of the data funnel. This data is piped into the next line, and filtered or manipulated using an operator. The surviving data is piped into the subsequent line, and so on until arriving at the final query output. This query output is returned in a tabular format. (Microsoft Learn)

Writing and Running Queries

You can write your query in the query editor and execute it by clicking on the Run button on the top bar, or pressing Shift + F5 (note that if you have multiple queries written in the editor, only the currently selected one will be executed).

👉 Continue reading the full article here: https://henriquesd.com/articles/writing-queries-with-kusto-query-language-kql