AzureHow-ToBeginner · 4 min read

How to Use KQL in Azure: Syntax, Examples, and Tips

To use KQL in Azure, open Azure Data Explorer or Azure Monitor Logs, then write queries using KQL syntax to retrieve and analyze data. You run these queries in the query editor to get results from your Azure data sources.

📐

Syntax

KQL queries start with a data source (table), followed by operators to filter, sort, and summarize data.

TableName: The data table to query.
|: Pipe operator to chain commands.
where: Filters rows based on conditions.
project: Selects specific columns.
summarize: Aggregates data.
order by: Sorts results.

kql

TableName
| where Condition
| project Column1, Column2
| summarize Count = count() by Column1
| order by Count desc

💻

Example

This example queries the AzureActivity table to find the count of activities by operation name in the last 7 days, sorted by count descending.

kql

AzureActivity
| where TimeGenerated > ago(7d)
| summarize ActivityCount = count() by OperationName
| order by ActivityCount desc

Output

OperationName ActivityCount -------------------- ------------- Create or Update VM 150 Delete Storage Account 75 Start VM 50 Stop VM 30

⚠️

Common Pitfalls

Common mistakes when using KQL include:

Forgetting the pipe | between commands.
Using incorrect column names or case sensitivity.
Not filtering data before summarizing, causing slow queries.
Misusing project and losing needed columns.

Always check your table schema and use where early to limit data.

kql

/* Wrong: Missing pipe operator */
AzureActivity
where TimeGenerated > ago(7d)
summarize count() by OperationName

/* Correct: Pipes used properly */
AzureActivity
| where TimeGenerated > ago(7d)
| summarize count() by OperationName

📊

Quick Reference

KQL Command	Description
where	Filters rows based on a condition
project	Selects specific columns
summarize	Aggregates data with functions like count()
order by	Sorts results ascending or descending
extend	Adds new calculated columns
limit	Limits the number of rows returned

✅

Key Takeaways

Use the pipe operator | to chain KQL commands clearly.

Start queries by filtering data with where to improve performance.

Check table column names carefully; KQL is case-sensitive.

Use summarize to aggregate data and order by to sort results.

Run queries in Azure Data Explorer or Azure Monitor Logs query editor.