In this article, We learn about Kusto Query Language (KQL), I will explain furthered and detailed as I can. Just follow and read clearly about this topics.
For more updates please do Subscribe via Email:
What is Kusto Query Language (KQL)
Kusto is a query language designed for big data workloads particularly using large amount of data in from things like logs and event sources. Kusto query is a read-only request to process data and return results. KQL is the first party query language for Kusto cluster used by Azure Data Explorer. Kusto Query is only good for pulling or getting data from the data bank.
Kusto query statement?
There are three kinds of user query statement?
- A tabular expression statement
- A let expression statement
- A set expression statement
All query statements are separated by a
; (semicolon), and only affect the query at hand.
Tabular expression statement
Tabular statement is the most common kind of kusto query statement. which means both its input and output consist of tables or tabular datasets. Tabular statements contain zero or more operators, each of which starts with a tabular input and returns a tabular output. Operators are sequenced by a
| (pipe). Data flows, or is piped, from one operator to the next. The data is filtered or manipulated at each step and then fed into the following step.
Let’s look at an example query.
Student // table | where status== "Active" // where condition | Project Firstname, Lastname, Middlename, GradeLevel, Status // selected columns to display
Let expression statement
You can use the Let statement to set a variable name equal to an expression or a function, or to create a views.
A let statement in kusto is just like a CTE in SQL. it can break up a complex expression into multiple parts, each represented by a variable. also can define constants outside of the query body for readability. and defining a variable once and using it multiple times within a query.
Syntax for scalar or tabular expressions
Let’s look at an example query.
let Studentstatus = "Active"; // initializing Let statement Student // table | where status== "Active" // where condition | Project Firstname, Lastname, Middlename, GradeLevel, Status // selected columns to display
Or we can do like this. Defining tabular statement to a let statement.
let Studentstatus = "Active"; // initializing Let statement let GetStudentList = ( // Student query is defined in GetStudentList varialble. Student // table | where status== "Active" // where condition | Project Firstname, Lastname, // selected columns to display Middlename, GradeLevel, Status ) GetStudentList // displaying the data, no need to specify the columns to view. by default // all avialble columns defined in GetStudentList variable will displayed.
set statement is used to set a query option for the duration of the query. Query options control how a query executes and returns results. They can be Boolean flags (off by default), or have an integer value. A query may contain zero, one, or more set statements. Set statements affect only the tabular expression statements that trail them in the program order. Any two statements must be separated by a semicolon. This is rarely use statement.
set querytrace; Events | take 100
Thank you for visiting my blog site. Hoping you learn more here. please feel free to comment and suggest if there is need to enhance and update. thank you.
In this article, I will know what is power automate, And Microsoft Power Automate, formerly known as Microsoft Flow, is a cloud-based service that allows […]
In this article, I will know what is power apps, And Microsoft Power Apps is a low-code development platform that allows users to easily create […]
In this article, I will introduce the new technology powered by Microsoft product which is Microsoft Power Platform. Microsoft Power Platform is a line of […]
In this article, We learn how to create a Personal Access Token in Azure DevOps. I will show how to do it, and just follow […]