Kusto Query Language (KQL) basics in Azure - Step-by-Step Execution

Process Flow - Kusto Query Language (KQL) basics

Start Query

↓

Read Table

↓

Apply Filters

↓

Project Columns

↓

Sort or Aggregate

↓

Return Results

KQL queries start by reading a table, then filter rows, select columns, optionally sort or aggregate, and finally return results.

Execution Sample

Azure

StormEvents
| where State == "TX"
| project StartTime, EventType
| sort by StartTime desc

This query reads the StormEvents table, filters for Texas events, selects StartTime and EventType columns, and sorts results by StartTime descending.

Process Table

Step	Action	Input Rows	Output Rows	Details
1	Read Table StormEvents	All rows	All rows	Load all data from StormEvents
2	Filter where State == "TX"	All rows	Filtered rows	Keep only rows where State is TX
3	Project StartTime, EventType	Filtered rows	Same rows	Select only StartTime and EventType columns
4	Sort by StartTime desc	Projected rows	Same rows	Order rows by StartTime newest first
5	Return Results	Sorted rows	Sorted rows	Output final result set

💡 Query completes after returning sorted filtered and projected rows.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Rows	N/A	All rows	Filtered rows (State == TX)	Projected rows (StartTime, EventType only)	Sorted rows by StartTime desc	Sorted filtered projected rows

Key Moments - 3 Insights

Why does the number of rows decrease after the filter step?

Because the filter keeps only rows where State equals TX, removing all others as shown in step 2 of the execution table.

Does projecting columns change the number of rows?

No, projecting only selects columns but keeps the same number of rows, as seen in step 3 where output rows remain the same.

What does sorting do to the data?

Sorting changes the order of rows but does not add or remove rows, as shown in step 4 where rows are ordered by StartTime descending.

Visual Quiz - 3 Questions

Look at the execution table, after which step are only Texas events kept?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Check the 'Action' and 'Details' columns in the execution table for step 2.

At which step does the query reduce columns to only StartTime and EventType?

A Step 3

B Step 2

C Step 4

D Step 5

💡 Hint

Look at the 'Project' action in the execution table.

If we remove the filter step, what happens to the number of rows after step 2?

A Rows decrease to only Texas events

B Rows stay the same as all rows are kept

C Rows increase

D Rows become zero

💡 Hint

Filtering is what reduces rows; without it, all rows remain.

Concept Snapshot

Kusto Query Language (KQL) basics:
- Start with a table name
- Use | to chain commands
- 'where' filters rows
- 'project' selects columns
- 'sort by' orders rows
- Results show filtered, selected, sorted data

Full Transcript

This visual execution traces a simple Kusto Query Language query. It starts by reading all rows from the StormEvents table. Then it filters rows to keep only those where the State is TX. Next, it projects only the StartTime and EventType columns, keeping the same number of rows. After that, it sorts the rows by StartTime in descending order. Finally, it returns the sorted, filtered, and projected results. Key moments include understanding that filtering reduces rows, projecting changes columns but not rows, and sorting changes order but not row count.