Kusto Query Language (KQL) basics in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What is the output count of this KQL query?

Given the table Logs with 5 rows, what is the output count of this query?

Logs | where Level == 'Error' | count

Azure

Logs | where Level == 'Error' | count

A 0

B 3

C 5

D 1

💡 Hint

Count returns the number of rows after filtering.

The query filters rows where Level is 'Error'. If 3 rows match, count returns 3.

🧠 Conceptual

intermediate

Which operator filters rows in KQL?

You want to select only rows where the column Status equals 'Success'. Which operator do you use?

A where

B project

C summarize

D extend

💡 Hint

Filtering means choosing rows based on a condition.

The where operator filters rows by a condition.

❓ Configuration

advanced

What is the output of this KQL query with summarize?

Given the table Sales with columns Region and Amount, what does this query output?

Sales | summarize TotalAmount = sum(Amount) by Region

Azure

Sales | summarize TotalAmount = sum(Amount) by Region

A A single value with the sum of all Amounts

B A table with all rows and a new column TotalAmount with sum of all Amounts

C A table with each Region and the sum of Amount for that Region

D An error because summarize needs a where clause

💡 Hint

Summarize groups rows by the column after 'by'.

The query groups rows by Region and sums Amount per group.

❓ security

advanced

Which KQL query prevents exposing sensitive data by masking?

You want to show user data but mask the Email column except the domain part. Which query achieves this?

A Users | extend EmailMasked = substring(Email, 0, 3) | project EmailMasked

B Users | project Email = '***@domain.com'

C Users | where Email contains '@' | project Email

D Users | extend EmailMasked = strcat('***@', extract('@(.+)$', 1, Email)) | project-away Email

💡 Hint

Masking means hiding part of the data but keeping some visible.

Option D keeps the domain visible and masks the user part with ***.

❓ Architecture

expert

What is the effect of this KQL query on data ingestion time?

Given a large streaming table Events, what does this query do?

Events | where Timestamp > ago(1h) | summarize Count = count() by bin(Timestamp, 5m)

Azure

Events | where Timestamp > ago(1h) | summarize Count = count() by bin(Timestamp, 5m)

A Returns counts of events in 5-minute intervals for the last hour, efficient for recent data

B Returns counts for all data ignoring the time filter, causing slow queries

C Returns a single count of all events in the last hour without grouping

D Causes an error because bin cannot be used with Timestamp

💡 Hint

The ago(1h) filters recent data, bin groups time.

The query efficiently summarizes recent events in 5-minute buckets.

Practice

1. What does the pipe symbol | do in a Kusto Query Language (KQL) query?

easy

A. It defines a variable

B. It connects commands to process data step-by-step

C. It comments out the rest of the line

D. It ends the query

Solution

1. Step 1: Understand the role of the pipe in KQL

   The pipe symbol | is used to chain commands, passing the output of one command as input to the next.

2. Step 2: Compare with other options

   It does not comment, define variables, or end queries; those are different syntax elements.

3. Final Answer:

   It connects commands to process data step-by-step -> Option B

4. Quick Check:

   Pipe = Connect commands [OK]

Hint: Remember: pipe means 'then do this' in KQL [OK]

Common Mistakes:

• Thinking pipe comments code
• Confusing pipe with variable assignment
• Assuming pipe ends the query

2. Which of the following is the correct syntax to filter rows where the column Age is greater than 30 in KQL?

easy

A. Table | select Age > 30

B. Table where Age > 30

C. Table | filter Age > 30

D. Table | where Age > 30

Solution

1. Step 1: Identify the correct filter syntax in KQL

   KQL uses the where keyword after a pipe to filter rows based on a condition.

2. Step 2: Check each option

   Table | where Age > 30 uses | where Age > 30, which is correct. Table where Age > 30 misses the pipe. Table | filter Age > 30 uses filter which is not valid in KQL. Table | select Age > 30 uses select incorrectly.

3. Final Answer:

   Table | where Age > 30 -> Option D

4. Quick Check:

   Filter rows = pipe + where [OK]

Hint: Filter with '| where condition' in KQL [OK]

Common Mistakes:

• Omitting the pipe before where
• Using 'filter' instead of 'where'
• Using 'select' to filter rows

3. Given the query:

StormEvents | where State == "TX" | summarize Count = count() by EventType

What does this query return?

medium

A. The total number of events in Texas grouped by event type

B. All events in Texas without grouping

C. The count of all events in the dataset

D. Events grouped by state and event type

Solution

1. Step 1: Analyze the filter condition

   The query filters rows where the State column equals "TX", so only Texas events remain.

2. Step 2: Understand the summarize operation

   The summarize Count = count() by EventType groups the filtered data by EventType and counts the number of events per type.

3. Final Answer:

   The total number of events in Texas grouped by event type -> Option A

4. Quick Check:

   Filter by state, then group and count by event type [OK]

Hint: Summarize groups and counts after filtering [OK]

Common Mistakes:

• Ignoring the filter and counting all events
• Not recognizing grouping by EventType
• Confusing summarize with select

4. Identify the error in this KQL query:

StormEvents | where State = "CA" | summarize total = count() by EventType

medium

A. Using single equals (=) instead of double equals (==) for comparison

B. Missing pipe before summarize

C. Incorrect use of count() function

D. EventType should be in quotes

Solution

1. Step 1: Check the filter condition syntax

   In KQL, equality comparison requires double equals ==, not single equals =.

2. Step 2: Verify other parts of the query

   The pipe before summarize is present, count() is used correctly, and EventType is a column name that does not need quotes.

3. Final Answer:

   Using single equals (=) instead of double equals (==) for comparison -> Option A

4. Quick Check:

   Comparison uses '==' not '=' [OK]

Hint: Use '==' for comparisons in KQL [OK]

Common Mistakes:

• Using '=' instead of '==' in where clause
• Adding quotes around column names
• Forgetting pipe before summarize

5. You want to find the top 3 states with the highest number of storm events. Which KQL query correctly achieves this?

hard

A. StormEvents | top 3 by State | summarize Count = count()

B. StormEvents | summarize Count = count() by State | sort by Count asc | limit 3

C. StormEvents | summarize Count = count() by State | top 3 by Count desc

D. StormEvents | where Count > 3 | summarize by State

Solution

1. Step 1: Summarize event counts by state

   The query must group events by State and count them using summarize Count = count() by State.

2. Step 2: Select top 3 states by count descending

   Use top 3 by Count desc to get the three states with the highest counts.

3. Final Answer:

   StormEvents | summarize Count = count() by State | top 3 by Count desc -> Option C

4. Quick Check:

   Group by state, count, then top 3 descending [OK]

Hint: Use 'summarize' then 'top' to get highest counts [OK]

Common Mistakes:

• Using top before summarize
• Sorting ascending instead of descending
• Filtering by Count before summarizing