You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|**Filter/Search/Condition**|**_Find relevant data by filtering or searching_**||
19
-
|[where](/azure/kusto/query/whereoperator.md)| Filters on a specific predicate |`T \| where Predicate`|
20
-
|[where condition/has](/azure/kusto/query/whereoperator.md)|Has: Looks for a specific word and delivers better performance <br> Contains: Looks for any substring match |`T \| where col1 contains/has "[search term]"`|
21
-
|[search](/azure/kusto/query/searchoperator.md)| Searches all columns in the table for the value |`[TabularSource \|] search [kind=CaseSensitivity] [in (TableSources)] SearchPredicate`|
22
-
|[take](/azure/kusto/query/takeoperator.md)| Returns the specified number of records - convenient to test a query<br>**_Note_** <br> _take_and _limit_ are synonyms. |`T \| take NumberOfRows`|
23
-
|[case](/azure/kusto/query/casefunction.md)|A condition statement, similar to if/then/elseif in other systems. |`case(predicate_1, then_1, predicate_2, then_2, predicate_3, then_3, else)`|
19
+
|[where](/azure/kusto/query/whereoperator.md)| Filters on a specific predicate | `T | where Predicate` |
20
+
|[where contains/has](/azure/kusto/query/whereoperator.md)|`Contains`: Looks for any substring match <br> `Has`: Looks for a specific word (better performance) | `T | where col1 contains/has "[search term]"`|
21
+
|[search](/azure/kusto/query/searchoperator.md)| Searches all columns in the table for the value | `[TabularSource |] search [kind=CaseSensitivity][in (TableSources)] SearchPredicate` |
22
+
|[take](/azure/kusto/query/takeoperator.md)| Returns the specified number of records. Use to test a query<br>**_Note_**: `_take`_ and `_limit`_ are synonyms. | `T | take NumberOfRows` |
23
+
|[case](/azure/kusto/query/casefunction.md)|Adds a condition statement, similar to if/then/elseif in other systems. |`case(predicate_1, then_1, predicate_2, then_2, predicate_3, then_3, else)`|
24
24
|[distinct](/azure/kusto/query/distinctoperator.md)| Produces a table with the distinct combination of the provided columns of the input table |`distinct [ColumnName], [ColumnName]`|
25
25
|**Date/Time**|**_Operations that use date and time functions_**||
26
26
|[ago](/azure/kusto/query/agofunction.md)| Returns the time offset relative to the time the query executes. For example, `ago(1h)` is one hour before the current clock’s reading. |`ago(a_timespan)`|
27
-
|[format_datetime](/azure/kusto/query/format-datetimefunction.md)| Returns data in specific date formats. Supported formats include:<br> - `f – fffffff` (fractions of a second from tenths of a second to ten millionths of a second)<br>- `F-FFFFFFF` (as above, but only non-zero results)<br>- `tt` (AM/PM)<br> The following in one, two, or four digits, as indicated:<br>- `s or ss` (second), `m` or `mm` (minute), `h` or`hh` (hour)<br>- `H` or `HH` (hour in 24-hour format)<br>- `d` or `dd` (day)<br>- `M` or `MM` (month)<br>- `y`, `yy`, or `yyyy` (year)|`format_datetime(datetime , format)`|
28
-
|[bin](/azure/kusto/query/binfunction.md)| Rounds all values in a timeframe (regardless of how those values are scattered) and groups them.|`bin(value,roundTo)`|
29
-
|**Creating/Removing Columns**|**_Add or remove columns in a table_**||
30
-
|[print](/azure/kusto/query/printoperator.md)| Outputs single row with one or more scalar expressions |`print [ColumnName =] ScalarExpression [',' ...]`|
31
-
|[project](/azure/kusto/query/projectoperator.md)|Select the columns to include in the order specified |`T \| project ColumnName [= Expression] [, ...]` <br> Or <br> `T \| project [ColumnName \| (ColumnName[,]) =] Expression [, ...]`|
32
-
|[project-away](/azure/kusto/query/projectawayoperator.md)|Select the columns to exclude from the output |`T \| project-away ColumnNameOrPattern [, ...]`|
33
-
|[extend](/azure/kusto/query/extendoperator.md)| Creates a calculated column and adds it to the result set |`T \| extend [ColumnName \| (ColumnName[, ...]) =] Expression [, ...]`|
34
-
|**Dataset: Sort and Aggregate**|**_Restructure the data by sorting or grouping them in meaningful ways_**||
35
-
|[sort](/azure/kusto/query/sortoperator.md)|Sort the rows of the input table by one or more columns in ascending or descending order |`T \| sort by expression1 [asc\|desc], expression2 [asc\|desc], …`|
36
-
|[top](/azure/kusto/query/topoperator.md)| Returns the first N rows of the dataset when the dataset is sorted “by”|`T \| top numberOfRows by expression [asc\|desc] [nulls first\|last]`|
37
-
|[summarize](/azure/kusto/query/summarizeoperator.md)| Groups the rows according to the “by” group columns, and calculates aggregations over each group |`T \| summarize [[Column =] Aggregation [, ...]] [by [Column =] GroupExpression [, ...]]`|
38
-
|[count](/azure/kusto/query/countoperator.md)| Counts records in the input table (for example, T)<br>This operator is shorthand for "summarize count()" |`T \| count`|
39
-
|[join](/azure/kusto/query/joinoperator.md)| Merges the rows of two tables to form a new table by matching values of the specified column(s) from each table. Supports a full range of join types: `flouter`, `inner`, `innerunique`, `leftanti`, `leftantisemi`, `leftouter`, `leftsemi`, `rightanti`, `rightantisemi`, `rightouter`, `rightsemi`|`LeftTable \| join [JoinParameters] ( RightTable ) on Attributes`|
40
-
|[union](/azure/kusto/query/unionoperator.md)| Takes two or more tables and returns all their rows |`[T1] \| union [T2], [T3], …`|
27
+
|[format_datetime](/azure/kusto/query/format-datetimefunction.md)| Returns data in [various date formats](/azure/kusto/query/format-datetimefunction.md#supported-formats).|`format_datetime(datetime , format)`|
28
+
|[bin](/azure/kusto/query/binfunction.md)| Rounds all values in a timeframe and groups them |`bin(value,roundTo)`|
29
+
|**Create/Remove Columns**|**_Add or remove columns in a table_**||
30
+
|[print](/azure/kusto/query/printoperator.md)| Outputs a single row with one or more scalar expressions |`print [ColumnName =] ScalarExpression [',' ...]`|
31
+
|[project](/azure/kusto/query/projectoperator.md)|Selects the columns to include in the order specified | `T | project ColumnName [= Expression][, ...]` <br> Or <br> `T | project [ColumnName | (ColumnName[,]) =] Expression [, ...]` |
32
+
|[project-away](/azure/kusto/query/projectawayoperator.md)|Selects the columns to exclude from the output | `T | project-away ColumnNameOrPattern [, ...]` |
33
+
|[extend](/azure/kusto/query/extendoperator.md)| Creates a calculated column and adds it to the result set | `T | extend [ColumnName | (ColumnName[, ...]) =] Expression [, ...]` |
34
+
|**Sort and Aggregate Dataset**|**_Restructure the data by sorting or grouping them in meaningful ways_**||
35
+
|[sort](/azure/kusto/query/sortoperator.md)|Sorts the rows of the input table by one or more columns in ascending or descending order | `T | sort by expression1 [asc|desc], expression2 [asc|desc], …` |
36
+
|[top](/azure/kusto/query/topoperator.md)| Returns the first N rows of the dataset when the dataset is sorted using `by`| `T | top numberOfRows by expression [asc|desc][nulls first|last]` |
37
+
|[summarize](/azure/kusto/query/summarizeoperator.md)| Groups the rows according to the `by` group columns, and calculates aggregations over each group | `T | summarize [[Column =] Aggregation [, ...]][by [Column =] GroupExpression [, ...]]` |
38
+
|[count](/azure/kusto/query/countoperator.md)| Counts records in the input table (for example, T)<br>This operator is shorthand for `summarize count()`| `T | count` |
39
+
|[join](/azure/kusto/query/joinoperator.md)| Merges the rows of two tables to form a new table by matching values of the specified column(s) from each table. Supports a full range of join types: `flouter`, `inner`, `innerunique`, `leftanti`, `leftantisemi`, `leftouter`, `leftsemi`, `rightanti`, `rightantisemi`, `rightouter`, `rightsemi`| `LeftTable | join [JoinParameters] ( RightTable ) on Attributes` |
40
+
|[union](/azure/kusto/query/unionoperator.md)| Takes two or more tables and returns all their rows | `[T1]| union [T2], [T3], …` |
41
41
|[range](/azure/kusto/query/rangeoperator.md)| Generates a table with an arithmetic series of values |`range columnName from start to stop step step`|
42
42
|**Format Data**|**_Restructure the data to output in a useful way_**||
43
-
|[lookup](/azure/kusto/query/lookupoperator.md)| Extends the columns of a fact table with values looked-up in a dimension table |`T1 \| lookup [kind = (leftouter\|inner)] ( T2 ) on Attributes`|
|[parse](/azure/kusto/query/parseoperator.md)| Evaluates a string expression and parses its value into one or more calculated columns. For example, `parse` is useful for structuring unstructured data. |`T \| parse [kind=regex [flags=regex_flags] \|simple\|relaxed] Expression with * (StringConstant ColumnName [: ColumnType]) *...`|
46
-
|[make-series](/azure/kusto/query/make-seriesoperator.md)| Creates series of specified aggregated values along a specified axis |`T \| make-series [MakeSeriesParamters] [Column =] Aggregation [default = DefaultValue] [, ...] on AxisColumn from start to end step step [by [Column =] GroupExpression [, ...]]`|
47
-
|[let](/azure/kusto/query/letstatement.md)| Binds a name to expressions and the name can be used to refer to its bound value. Values can be lambda expressions, so it can create ad-hoc functions as part of the query. Use "let" to create expressions over tables whose results look like a new table. |`let Name = ScalarExpression \| TabularExpression \| FunctionDefinitionExpression`|
43
+
|[lookup](/azure/kusto/query/lookupoperator.md)| Extends the columns of a fact table with values looked-up in a dimension table | `T1 | lookup [kind = (leftouter|inner)] ( T2 ) on Attributes` |
|[parse](/azure/kusto/query/parseoperator.md)| Evaluates a string expression and parses its value into one or more calculated columns. Use for structuring unstructured data. | `T | parse [kind=regex [flags=regex_flags]|simple|relaxed] Expression with * (StringConstant ColumnName [: ColumnType]) *...` |
46
+
|[make-series](/azure/kusto/query/make-seriesoperator.md)| Creates series of specified aggregated values along a specified axis | `T | make-series [MakeSeriesParamters][Column =] Aggregation [default = DefaultValue][, ...] on AxisColumn from start to end step step [by [Column =] GroupExpression [, ...]]` |
47
+
|[let](/azure/kusto/query/letstatement.md)| Binds a name to expressions that can refer to its bound value. Values can be lambda expressions to create ad-hoc functions as part of the query. Use `let` to create expressions over tables whose results look like a new table. | `let Name = ScalarExpression | TabularExpression | FunctionDefinitionExpression` |
48
48
|**General**|**_Miscellaneous operations and function_**||
49
-
|[invoke](/azure/kusto/query/invokeoperator.md)| Runs the function on the table that it receives as input. |`T \| invoke function([param1, param2])`|
0 commit comments