Kusto Query Language (KQL) basics in Azure - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Kusto Query Language (KQL)?

KQL is a simple, read-only language used to query large sets of data quickly in Azure Data Explorer and other Microsoft services.

beginner

How do you filter rows in KQL?

Use the where keyword followed by a condition to filter rows that meet that condition.

beginner

What does the project operator do in KQL?

It selects specific columns from the data, similar to choosing which columns to see in a table.

intermediate

Explain the use of the summarize operator in KQL.

It groups data and calculates aggregates like count, sum, or average for each group.

beginner

How do you sort results in KQL?

Use the order by keyword followed by the column name and direction (asc or desc).

Which KQL operator filters rows based on a condition?

A project

B where

C summarize

D order by

The where operator filters rows that meet a specified condition.

What does the project operator do?

A Selects columns

B Filters rows

C Groups data

D Sorts data

The project operator selects specific columns to include in the output.

Which operator would you use to calculate the total count of rows grouped by a column?

A summarize

B project

C where

D order by

The summarize operator groups data and calculates aggregates like count.

How do you sort query results in descending order by a column named 'Timestamp'?

A order by Timestamp asc

B sort Timestamp desc

C order by Timestamp desc

D sort Timestamp asc

Use order by Timestamp desc to sort results descending by 'Timestamp'.

Which of these is NOT a valid KQL operator?

A where

B project

C summarize

D filter

KQL uses where for filtering, not filter.

Describe how you would write a KQL query to find all records where the 'Status' column equals 'Error' and only show the 'Timestamp' and 'Message' columns.

Think about filtering first, then choosing columns.

Explain how to group data by a column and count the number of records in each group using KQL.

Use summarize with count and specify the grouping column.