Skip to content

Commit

Permalink
Update assessment.md - INTERIM SAVE
Browse files Browse the repository at this point in the history
-preliminary changes only-
  • Loading branch information
TFS-82 authored Dec 10, 2024
1 parent c97e92a commit 28fed1c
Showing 1 changed file with 49 additions and 29 deletions.
78 changes: 49 additions & 29 deletions data-explorer/kusto/query/assessment.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,61 +5,80 @@ ms.reviewer: orspod
ms.topic: reference
ms.date: 08/11/2024
---
# Kusto Query Language
# Kusto Query Language (KQL) introduction

Kusto Query Language is a powerful tool to explore your data and discover patterns, identify anomalies and outliers, create statistical modeling, etc.
You can query different kinds of data. The language is expressive, easy to read and understand the query intent, and optimized for authoring experiences. Kusto Query Language is optimal for querying telemetry, metrics, and logs with deep support for text search and parsing, time-series operators and functions, analytics and aggregation, geospatial, vector similarity searches, and many other language constructs that provide the most optimal language for data analysis. The query uses schema entities that are organized in a hierarchy similar to SQLs: databases, tables, and columns.
Kusto Query Language (KQL) is a powerful tool for exploring your data, uncovering patterns, identifying anomalies and outliers, creating statistical models, and more.
KQL is a versatile language that allows you to query all types of data structures effectively. The language is expressive and straightforward, making queries easy to read, author, and understand.

This article provides an explanation of the query language and offers practical exercises to get you started writing queries. To access the query environment, use the [Azure Data Explorer web UI](https://dataexplorer.azure.com/). To learn how to use KQL, see [Tutorial: Learn common operators](tutorials/learn-common-operators.md).
This article helps you begin to unlock your data by offering an introduction to KQL, as well as resources to help you start writing valuable queries.

The most common kind of query statement is a tabular expression **statement**, which means both its input and output consist of tables or tabular datasets. Tabular statements contain zero or more **operators**, each of which starts with a tabular input and returns a tabular output. Operators are sequenced by a `|` (pipe). Data flows, or is piped, from one operator to the next. The data is filtered or manipulated at each step and then fed into the following step.
## What is a Kusto query?
A Kusto query is a read-only request to process data and return results. The request appears in plain text, using a highly accessible data format. Any Kusto query is made of one or more query statements, each separated by a semicolon (`;`).

A Kusto query is a read-only request to process data and return results. The request is stated in plain text, using a data-flow model that is easy to read, author, and automate. Kusto queries are made of one or more query statements.
> [!NOTE]
> KQL is case-sensitive for all inputs, including table names, table column names, operators, functions, and so on.
There are two kinds of user [query statements](statements.md):

### What are query statements?
Query statements break down into two categories:
- Statements primarily used by users ([user query statements](https://learn.microsoft.com/en-us/kusto/query/statements?view=azure-data-explorer#user-query-statements))
- Statements designed to support scenarios in which mid-tier applications modify user queries and send them to Kusto ([application query statements](https://learn.microsoft.com/en-us/kusto/query/statements?view=azure-data-explorer#application-query-statements)).

This article will focus only on types of user query statements.

### Kinds of user query statements
There are three kinds of user [query statements](statements.md):

1. A [tabular expression statement](tabular-expression-statements.md)
1. A [let statement](let-statement.md)
1. A [set statement](set-statement.md)

All query statements are separated by a `;` (semicolon), and only affect the query at hand.
> [!NOTE]
> All KQL queries require at least one tabular expression statement.
### Parameters by query statement type
Each type of user query statement has its own distinct syntax and set of parameters.

#### Tabular expresssion statements

|Name|Type|Required|Description|
|--|--|--|--|
|*Source*| `string` | :heavy_check_mark:|A tabular data source. See [Tabular data sources](#tabular-data-sources).|
|*Operator*| `string` | :heavy_check_mark:|Tabular data operators, such as filters and projections.|
|*RenderInstruction*| `string` ||Rendering operators or instructions.|

#### Let statements

#### Set statements

| Name | Type | Required | Description |
|--|--|--|--|
| *OptionName* | `string` | :heavy_check_mark: | The name of the request property.|
| *OptionValue* | | :heavy_check_mark: | The value of the request property.|

For information about application query statements, see [Application query statements](statements.md#application-query-statements).
## Access the query environment
To access the query environment, use the [Azure Data Explorer web UI](https://dataexplorer.azure.com/). To learn how to use KQL, see [Tutorial: Learn common operators](tutorials/learn-common-operators.md).


It's like a funnel, where you start out with an an entire data table. Each time the data passes through another operator, it's filtered, rearranged, or summarized. Because the piping of information from one operator to another is sequential, the query operator order is important, and can affect both results and performance. At the end of the funnel, you're left with a refined output.

Why don't you see an example query.
## Example
The following query counts the number of records in the `StormEvents` table whose `StartTime` is between January 11-12, 2007 and which have a value of `Florida` in the `State` column.

> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAAwsuyS/KdS1LzSspVuCqUSjPSC1KVQguSSwqCcnMTVVISi0pT03NU9BISSxJLQGKaBgZGJjrGhrqGhhqKujpKaCJG4HENZENKklVsLVVUHLz8Q/ydHFUUgDZkpxfmlcCAIItD6l6AAAA" target="_blank">Run the query</a>
```kusto
StormEvents
| where StartTime between (datetime(2007-11-01) .. datetime(2007-12-01))
| where State == "florida"
| where State == "Florida"
| count
```

The query returned a result of 28 records meeting the requested criteria:
|Count|
|-----|
| 28|

Did you no, KQL is case-sensitive for everything – table names, table column names, operators, functions, and so on.

This query has a single tabular expression statement. The statement begins with a reference to a table called *StormEvents* and contains several operators, [`where`](where-operator.md) and [`count`](count-operator.md), each separated by a pipe. The data rows for the source table are filtered by the value of the *StartTime* column and then filtered by the value of the *State* column. In the last line, the query returns a table with a single column and a single row containing the count of the remaining rows.

In contrast to Kusto queries, [Management commands](../management/index.md are requests to Kusto to process or modify data or metadata. For example, the following management command creates a new Kusto table with two columns, `Level` and `Number`:

```kusto
.create table Logs (Level:string, Text:string)
```

Management commands have their own syntax, which isn't part of the Kusto Query Language syntax, although the two share many concepts. In particular, management comands are distinguished from queries by having the first character in the text of the command be the dot (`.`) character (which can't start a query). Why do we do it like this? This distinction prevents many kinds of security attacks, simply because it prevents embedding management commands inside queries.

Not all management commands modify data or metadata. The large class of commands that start with `.show`, are used to display metadata or data. For example, the `.show tables` command returns a list of all tables in the current database.

For more information on management commands, see [Management commands overview](../management/index.md).

## KQL in other services

Expand All @@ -71,10 +90,11 @@ KQL is used by many other Microsoft services. For specific information on the us
[Proactively hunt for threats with advanced hunting in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-overview)
[CMPivot queries](/mem/configmgr/core/servers/manage/cmpivot-overview#queries)

## Related stuff
## References and tutorials

* [Tytorial: Learn common operators](tutorials/learn-common-operators.md)
* [Tutorial: Learn common operators](tutorials/learn-common-operators.md)
* [Tutorial: Use aggregation functions](tutorials/use-aggregation-functions.md)
* [KQL quick reference](kql-quick-reference.md)
* [SQL to Kusto Query Language cheat sheet](sql-cheat-sheet.md)
* [Query best practices](best-practices.md)
* [About management commands](../management/index.md)

0 comments on commit 28fed1c

Please sign in to comment.