Questions tagged [kql]

Kusto Query Language (KQL). Use this tag with any questions or advice of operator, complicated query, performance challenges or missing capabilities. KQL is a read-only request to process data and return results. The request is stated in plain text, using a data-flow model designed to make the syntax easy, author and automate. The query uses schema entities that are organized in a hierarchy similar to SQL's: databases, tables, and columns.

Pluralsight Course: Basics of KQL


How to write a good KQL question?

  1. Provide proper sample data.
    • That includes data + schema (tables' names + columns' names & data types).
    • Make sure you cover all relevant edge cases.
    • No need to post real data. Synthetic data is good enough, as long as it matches the structure and patterns of the original data.
  2. Provide required results.
    • Required results should match the provided sample data.
  3. Provide _short_ explanation.
  4. Adding code / pseudo code is fine, as long as you narrow it to the minimal form needed to make your point.
    • DO NOT post your 100 rows query As Is
    • The code should match the sample data schema.

Per StackOverflow guidelines, DO NOT post images of code or data.

  • Keep your code formatted by wrapping it with triple-backtick (```), e.g.:
```
MyTable
| count
```

Original data

a   y   z
1   2   3   
4   5   6   

GitHub Markdown

| a | y | z |
|---|---|---|
| 1 | 2 | 3 |
| 4 | 5 | 6 |

How it looks on your post:

a y z
1 2 3
4 5 6
1813 questions
17
votes
1 answer

How to remove time part from a datetime in Kusto

If I've got a Kusto datetime and I want to remove the time portion, leaving just a date at midnight, what's the best way? I can do this todatetime(format_datetime( now(), "yyyy-MM-dd")) but surely there's a more efficient way?
Rory
  • 40,559
  • 52
  • 175
  • 261
13
votes
1 answer

Kusto !has_any | where value does not contain any value in set

Is there a built-in way in Kusto to check that a value does not contain multiple items? I know that I can use has_any to check if an item contains any values in a set, but I can't seem to get it to work with an "!" operator. Example: let Employees =…
SendETHToThisAddress
  • 2,756
  • 7
  • 29
  • 54
13
votes
1 answer

Kusto create an in-memory table for testing

Just looking to create a quick in-memory/temp table for testing out queries. I've seen this done before but I'm having trouble finding any examples from a web search or StackOverflow search. I'm looking for something like this: let TempTable =…
SendETHToThisAddress
  • 2,756
  • 7
  • 29
  • 54
12
votes
2 answers

How to query my Application Insights Logs (Analytics) from Kusto.Explorer?

Update July 13, 2021 The links used below are now partially obsolete. Here is the new section on language differences. Original post On Azure Portal, in my App Insights / Logs view, I can query the app data like this: app('my-app-name').traces The…
11
votes
2 answers

Using both 'distinct' and 'project'

In Azure Data Explorer, I am trying to use both the 'project' and 'distinct' keywords. The table records have 3 fields I want to use the 'project' on: CowName CowType CowNum CowLabel But there are many other fields in the table such as Date,…
Adam
  • 155
  • 1
  • 2
  • 9
10
votes
3 answers

How do I print a tree using the Kusto Query Language?

Below is a quick and unglamorous solution. If you have a better one, please include it in your answer. let tree_height = 15; range i from -1 to tree_height * 2 step 2 | extend side_width = tree_height + 1 - i / 2 | extend side_space = strrep(" ",…
10
votes
1 answer

Kusto | Summarize count() multiple columns with where clauses

I'm trying to get the count of multiple things in a Kusto query but having trouble getting it working. Let's say I have a sample table like this: let SampleTable = datatable(Department:string, Status:string, DateStamp:datetime) [ "Logistics",…
SendETHToThisAddress
  • 2,756
  • 7
  • 29
  • 54
10
votes
1 answer

How do I write a Kusto query that uses a regex to filter on a where clause

In Azure Log Analytics I'm trying to use Kusto to query requests with a where condition that uses a regex. The query I'm trying is requests | where customDimensions.["API Name"] matches regex "\w*-v\d*" but this returns a syntax error. The…
Nick Graham
  • 1,311
  • 3
  • 14
  • 21
10
votes
2 answers

How to write Kusto query to get results in one table?

I have 2 KQL queries and I want to combine them in order to display two rows as one result. Not just result of first query, then result of second query: R_CL | where isnotempty(SrcIP_s) | project Message | take 1; R_CL | where isempty(SrcIP_s)…
irom
  • 3,316
  • 14
  • 54
  • 86
9
votes
3 answers

Azure KUSTO statment fails with "No tabular statement found"

Can someone tell me why this Kusto statement in Log Analytics fails with "no tabular statement found"? let eventcnt = Event | where TimeGenerated > ago(10m) I can run this query and a table of data is returned: Event | where TimeGenerated >…
jpsebasti
  • 91
  • 1
  • 1
  • 2
9
votes
2 answers

How to use mvexpand on an json array of key/value pairs

I have a custom property in my appInsights telemetry that is a json array of a key/value pairs. What I want to do is project out that key/value pair and it seems that using parsejson and mvexpand together is how to achieve this; however, I seem to…
Tedford
  • 2,842
  • 2
  • 35
  • 45
8
votes
2 answers

How to get the minutes from a timespan in KQL

I wanted to extract the time in minutes for a Kusto query I was working on. I have a cloumn where timespan is represented in the following format (HH:MM:SS.MilliSeconds) 01:18:54.0637555. I wanted to extract the number of minutes from this in this…
Vaibhav Garg
  • 107
  • 1
  • 8
8
votes
2 answers

Query multiple tables in Azure Log Analytics

I am looking at Azure log analytics for a web app, and I have multiple out-of-the-box "tables" containing data: traces, requests, exceptions, etc. Can I construct a query that runs on data from multiple tables? I don't want to join data from…
Peter
  • 3,619
  • 3
  • 31
  • 37
8
votes
2 answers

Kusto query to show summary by percent of totals

I am trying to get summary of failures in percentages of totals, see my query below. It is good, but I want it to show me Vendor1=0.5 and Vendor2=0.5 (50% failures), and not just Vendor1=1 (one failure with 0), Vendor2=2 (two failures of…
irom
  • 3,316
  • 14
  • 54
  • 86
7
votes
1 answer

Get top 1 row of each group using Kusto

I have a table which I would like to get the latest entry for each group using Kusto Query Language. Here's the…
1
2 3
99 100