From 3bc6ba376220b7154944024d65787c9de65cb869 Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Mon, 25 Nov 2024 13:06:20 +0200 Subject: [PATCH 1/6] Add timestamp between example --- .../query/tutorials/learn-common-operators.md | 37 ++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/data-explorer/kusto/query/tutorials/learn-common-operators.md b/data-explorer/kusto/query/tutorials/learn-common-operators.md index 25c4b04e2a..a6e65ec880 100644 --- a/data-explorer/kusto/query/tutorials/learn-common-operators.md +++ b/data-explorer/kusto/query/tutorials/learn-common-operators.md @@ -2,7 +2,7 @@ title: 'Tutorial: Learn common Kusto Query Language operators' description: This tutorial describes how to write queries using common operators in the Kusto Query Language to meet common query needs. ms.topic: tutorial -ms.date: 08/11/2024 +ms.date: 11/25/2024 --- # Tutorial: Learn common operators @@ -30,6 +30,7 @@ In this tutorial, you'll learn how to: > * [Select a subset of columns](#select-a-subset-of-columns) > * [List unique values](#list-unique-values) > * [Filter by condition](#filter-by-condition) +> * [Filter by time range](#filter-by-time-range) > * [Sort results](#sort-results) > * [Get the top *n* rows](#get-the-top-n-rows) > * [Create calculated columns](#create-calculated-columns) @@ -182,6 +183,40 @@ There are 146 events that match these conditions. Here's a sample of 5 of them. |2007-03-12T02:30:00Z|2007-03-12T06:45:00Z|TEXAS|Flood|0| |...|...|...|...|...| +## Filter by date and time range + +Use the [between operator](../between-operator.md) to filter data based on a specific time range. + +The following query finds all storm events that started in August 2007, along with their states, event types, start and end times. The results are then sorted in ascending order. + +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + +```Kusto +StormEvents +| where StartTime >= datetime(2007-08-01 00:00:00) and StartTime < datetime(2007-08-30 23:59:59) +| project State, EventType, StartTime, EndTime +| sort by StartTime asc +``` + +**Output** + +| State | Eventype | StartTime | EndTime | +|--|--|--|--| +| GEORGIA | Excessive Heat | 2007-08-01 00:00:00 | 2007-08-27 23:59:00 | +| TENNESSEE | Drought | 2007-08-01 00:00:00 | 2007-08-31 23:59:00 | +| TENNESSEE | Drought | 2007-08-01 00:00:00 | 2007-08-3123:59:00 | +| SOUTH CAROLINA | Drought | 2007-08-01 00:00:00Z | 2007-08-31 23:59:00 | +| TENNESSEE | Drought | 2007-08-01 00:00:00Z | 2007-08-31 23:59:00 | +| GEORGIA | Excessive Heat | 2007-08-01 00:00:00Z | 2007-08-27 23:59:00 | +| TENNESSEE | Drought | 2007-08-01 00:00:00Z | 2007-08-31 23:59:00 | +| MINNESOTA | Drought | 2007-08-01 00:00:00Z | 2007-08-31 23:59:00 | +| WISCONSIN | Drought | 2007-08-01 00:00:00Z | 2007-08-31 23:59:00 | +| GEORGIA | Excessive Heat | 2007-08-01 00:00:00Z | 2007-08-27 23:59:00 | +|...|...|...|...| + ## Sort results To view the top floods in Texas that caused the most damage, use the [sort](../sort-operator.md) operator to arrange the rows in descending order based on the `DamageProperty` column. The default sort order is descending. To sort in ascending order, specify `asc`. From 6d8b9d7552024ef621f53543ca56ab0b5698c636 Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Mon, 25 Nov 2024 13:08:36 +0200 Subject: [PATCH 2/6] fix parse --- data-explorer/kusto/query/parse-json-function.md | 1 - 1 file changed, 1 deletion(-) diff --git a/data-explorer/kusto/query/parse-json-function.md b/data-explorer/kusto/query/parse-json-function.md index 6bda97af36..8eea15f892 100644 --- a/data-explorer/kusto/query/parse-json-function.md +++ b/data-explorer/kusto/query/parse-json-function.md @@ -38,7 +38,6 @@ An object of type `dynamic` that is determined by the value of *json*: ## Example -In the following example, when `context_custom_metrics` is a `string` that looks like this: In the following example, when `context_custom_metrics` is a `string` that looks like this: ```json From d61349d974f282830d5d1cd756c2c208b6f91aed Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Mon, 25 Nov 2024 13:10:34 +0200 Subject: [PATCH 3/6] shortcut link --- data-explorer/kusto/query/tutorials/learn-common-operators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data-explorer/kusto/query/tutorials/learn-common-operators.md b/data-explorer/kusto/query/tutorials/learn-common-operators.md index a6e65ec880..6f444f584b 100644 --- a/data-explorer/kusto/query/tutorials/learn-common-operators.md +++ b/data-explorer/kusto/query/tutorials/learn-common-operators.md @@ -30,7 +30,7 @@ In this tutorial, you'll learn how to: > * [Select a subset of columns](#select-a-subset-of-columns) > * [List unique values](#list-unique-values) > * [Filter by condition](#filter-by-condition) -> * [Filter by time range](#filter-by-time-range) +> * [Filter by time range](#filter-by-date-and-time-range) > * [Sort results](#sort-results) > * [Get the top *n* rows](#get-the-top-n-rows) > * [Create calculated columns](#create-calculated-columns) From c82a8fa84991a0a0489b3af8e760d2a8eb7d94a6 Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Mon, 25 Nov 2024 13:14:31 +0200 Subject: [PATCH 4/6] Reorder topics --- .../query/tutorials/learn-common-operators.md | 68 +++++++++---------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/data-explorer/kusto/query/tutorials/learn-common-operators.md b/data-explorer/kusto/query/tutorials/learn-common-operators.md index 6f444f584b..ba6c9f0fd7 100644 --- a/data-explorer/kusto/query/tutorials/learn-common-operators.md +++ b/data-explorer/kusto/query/tutorials/learn-common-operators.md @@ -155,6 +155,33 @@ There are 46 types of storms in the table. Here's a sample of 10 of them. |Flood| |...| +## Sort results + +To view the top floods in Texas that caused the most damage, use the [sort](../sort-operator.md) operator to arrange the rows in descending order based on the `DamageProperty` column. The default sort order is descending. To sort in ascending order, specify `asc`. + +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + +```Kusto +StormEvents +| where State == 'TEXAS' and EventType == 'Flood' +| sort by DamageProperty +| project StartTime, EndTime, State, EventType, DamageProperty +``` + +**Output** + +|StartTime|EndTime|State|EventType|DamageProperty| +|--|--|--|--|--| +|2007-08-18T21:30:00Z|2007-08-19T23:00:00Z|TEXAS|Flood|5000000| +|2007-06-27T00:00:00Z|2007-06-27T12:00:00Z|TEXAS|Flood|1200000| +|2007-06-28T18:00:00Z|2007-06-28T23:00:00Z|TEXAS|Flood|1000000| +|2007-06-27T00:00:00Z|2007-06-27T08:00:00Z|TEXAS|Flood|750000| +|2007-06-26T20:00:00Z|2007-06-26T23:00:00Z|TEXAS|Flood|750000| +|...|...|...|...|...| + ## Filter by condition The [where](../where-operator.md) operator filters rows of data based on certain criteria. @@ -208,42 +235,15 @@ StormEvents | GEORGIA | Excessive Heat | 2007-08-01 00:00:00 | 2007-08-27 23:59:00 | | TENNESSEE | Drought | 2007-08-01 00:00:00 | 2007-08-31 23:59:00 | | TENNESSEE | Drought | 2007-08-01 00:00:00 | 2007-08-3123:59:00 | -| SOUTH CAROLINA | Drought | 2007-08-01 00:00:00Z | 2007-08-31 23:59:00 | -| TENNESSEE | Drought | 2007-08-01 00:00:00Z | 2007-08-31 23:59:00 | -| GEORGIA | Excessive Heat | 2007-08-01 00:00:00Z | 2007-08-27 23:59:00 | -| TENNESSEE | Drought | 2007-08-01 00:00:00Z | 2007-08-31 23:59:00 | -| MINNESOTA | Drought | 2007-08-01 00:00:00Z | 2007-08-31 23:59:00 | -| WISCONSIN | Drought | 2007-08-01 00:00:00Z | 2007-08-31 23:59:00 | -| GEORGIA | Excessive Heat | 2007-08-01 00:00:00Z | 2007-08-27 23:59:00 | +| SOUTH CAROLINA | Drought | 2007-08-01 00:00:00 | 2007-08-31 23:59:00 | +| TENNESSEE | Drought | 2007-08-01 00:00:00 | 2007-08-31 23:59:00 | +| GEORGIA | Excessive Heat | 2007-08-01 00:00:00 | 2007-08-27 23:59:00 | +| TENNESSEE | Drought | 2007-08-01 00:00:00 | 2007-08-31 23:59:00 | +| MINNESOTA | Drought | 2007-08-01 00:00:00 | 2007-08-31 23:59:00 | +| WISCONSIN | Drought | 2007-08-01 00:00:00 | 2007-08-31 23:59:00 | +| GEORGIA | Excessive Heat | 2007-08-01 00:00:00 | 2007-08-27 23:59:00 | |...|...|...|...| -## Sort results - -To view the top floods in Texas that caused the most damage, use the [sort](../sort-operator.md) operator to arrange the rows in descending order based on the `DamageProperty` column. The default sort order is descending. To sort in ascending order, specify `asc`. - -:::moniker range="azure-data-explorer" -> [!div class="nextstepaction"] -> Run the query -::: moniker-end - -```Kusto -StormEvents -| where State == 'TEXAS' and EventType == 'Flood' -| sort by DamageProperty -| project StartTime, EndTime, State, EventType, DamageProperty -``` - -**Output** - -|StartTime|EndTime|State|EventType|DamageProperty| -|--|--|--|--|--| -|2007-08-18T21:30:00Z|2007-08-19T23:00:00Z|TEXAS|Flood|5000000| -|2007-06-27T00:00:00Z|2007-06-27T12:00:00Z|TEXAS|Flood|1200000| -|2007-06-28T18:00:00Z|2007-06-28T23:00:00Z|TEXAS|Flood|1000000| -|2007-06-27T00:00:00Z|2007-06-27T08:00:00Z|TEXAS|Flood|750000| -|2007-06-26T20:00:00Z|2007-06-26T23:00:00Z|TEXAS|Flood|750000| -|...|...|...|...|...| - ## Get the top *n* rows The [top](../top-operator.md) operator returns the first *n* rows sorted by the specified column. From 6d9141f5e8eb0751244646c17aa145dcd04b4559 Mon Sep 17 00:00:00 2001 From: Andy Kopelowitz <165172502+AndyKop@users.noreply.github.com> Date: Tue, 3 Dec 2024 12:09:11 +0200 Subject: [PATCH 5/6] Update data-explorer/kusto/query/tutorials/learn-common-operators.md Co-authored-by: Yael Schuster-Davidi <62833511+YaelSchuster@users.noreply.github.com> --- data-explorer/kusto/query/tutorials/learn-common-operators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data-explorer/kusto/query/tutorials/learn-common-operators.md b/data-explorer/kusto/query/tutorials/learn-common-operators.md index ba6c9f0fd7..2d35998cab 100644 --- a/data-explorer/kusto/query/tutorials/learn-common-operators.md +++ b/data-explorer/kusto/query/tutorials/learn-common-operators.md @@ -214,7 +214,7 @@ There are 146 events that match these conditions. Here's a sample of 5 of them. Use the [between operator](../between-operator.md) to filter data based on a specific time range. -The following query finds all storm events that started in August 2007, along with their states, event types, start and end times. The results are then sorted in ascending order. +The following query finds all storm events between August 1, 2007 and August 30, 2007, along with their states, event types, start and end times. The results are then sorted in ascending order by start time. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] From d74554a306068bc65f027cdf4fbd2d5809554f35 Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Tue, 3 Dec 2024 12:21:46 +0200 Subject: [PATCH 6/6] review updates --- .../kusto/query/tutorials/learn-common-operators.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/data-explorer/kusto/query/tutorials/learn-common-operators.md b/data-explorer/kusto/query/tutorials/learn-common-operators.md index 2d35998cab..a3da785b54 100644 --- a/data-explorer/kusto/query/tutorials/learn-common-operators.md +++ b/data-explorer/kusto/query/tutorials/learn-common-operators.md @@ -90,7 +90,7 @@ StormEvents | take 5 ``` -The following table shows only 5 of the 22 returned columns. To see the full output, run the query. +The following table shows only five of the 22 returned columns. To see the full output, run the query. |StartTime|EndTime|EpisodeId|EventId|State|EventType|...| |--|--|--|--|--|--|--| @@ -218,12 +218,12 @@ The following query finds all storm events between August 1, 2007 and August 30, :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] -> Run the query +> Run the query ::: moniker-end ```Kusto StormEvents -| where StartTime >= datetime(2007-08-01 00:00:00) and StartTime < datetime(2007-08-30 23:59:59) +| where StartTime between (datetime(2007-08-01 00:00:00) .. datetime(2007-08-30 23:59:59)) | project State, EventType, StartTime, EndTime | sort by StartTime asc ```