Skip to content

Commit 146ad84

Browse files
Merge pull request #2538 from MicrosoftDocs/main638744402940479784sync_temp
For protected branch, push strategy should use PR and merge to target branch method to work around git push error
2 parents 1c12e22 + f81ac6c commit 146ad84

17 files changed

+345
-101
lines changed

data-explorer/kusto/management/callout-policy.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ Callout policies are managed at cluster-level and are classified into the follow
3838
| sandbox_artifacts | Controls sandboxed plugins ([python](../query/python-plugin.md) and [R](../query/r-plugin.md)). |
3939
| external_data | Controls access to external data through [external tables](../query/schema-entities/external-tables.md) or [externaldata](../query/externaldata-operator.md) operator. |
4040
| webapi | Controls access to http endpoints. |
41-
| ai_embed_text | Controls the [ai_embed_text plugin)](../query/ai-embed-text-plugin.md). |
41+
| azure_openai | Controls calls to Azure OpenAI plugins such as the embedding plugin [ai_embed_text plugin](../query/ai-embed-text-plugin.md). |
4242

4343
## Predefined callout policies
4444

data-explorer/kusto/query/parse-kv-operator.md

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: parse-kv operator
33
description: Learn how to use the parse-kv operator to represent structured information extracted from a string expression in a key/value form.
44
ms.reviewer: alexans
55
ms.topic: reference
6-
ms.date: 08/11/2024
6+
ms.date: 02/06/2025
77
---
88

99
# parse-kv operator
@@ -14,13 +14,13 @@ Extracts structured information from a string expression and represents the info
1414

1515
The following extraction modes are supported:
1616

17-
* [**Specified delimeter**](#specified-delimeter): Extraction based on specified delimiters that dictate how keys/values and pairs are separated from each other.
18-
* [**Non-specified delimeter**](#nonspecified-delimiter): Extraction with no need to specify delimiters. Any nonalphanumeric character is considered a delimiter.
17+
* [**Specified delimiter**](#specified-delimiter): Extraction based on specified delimiters that dictate how keys/values and pairs are separated from each other.
18+
* [**Non-specified delimiter**](#nonspecified-delimiter): Extraction with no need to specify delimiters. Any nonalphanumeric character is considered a delimiter.
1919
* [**Regex**](#regex): Extraction based on [regular expressions](regex.md).
2020

2121
## Syntax
2222

23-
### Specified delimeter
23+
### Specified delimiter
2424

2525
*T* `|` `parse-kv` *Expression* `as` `(` *KeysList* `)` `with` `(` `pair_delimiter` `=` *PairDelimiter* `,` `kv_delimiter` `=` *KvDelimiter* [`,` `quote` `=` *QuoteChars* ... [`,` `escape` `=` *EscapeChar* ...]] [`,` `greedy` `=` `true`] `)`
2626

@@ -52,16 +52,17 @@ The original input tabular expression *T*, extended with columns per specified k
5252

5353
> [!NOTE]
5454
>
55-
> * If a key doesn't appear in a record, the corresponding column value will either be `null` or an empty string, depending on the column type.
55+
> * If a key doesn't appear in a record, the corresponding column value is either `null` or an empty string, depending on the column type.
5656
> * Only keys that are listed in the operator are extracted.
5757
> * The first appearance of a key is extracted, and subsequent values are ignored.
58-
> * When extracting keys and values, leading and trailing white spaces are ignored.
58+
> * When you extract keys and values, leading and trailing white spaces are ignored.
5959
6060
## Examples
6161

62+
The examples in this section show how to use the syntax to help you get started.
6263
### Extraction with well-defined delimiters
6364

64-
In the following example, keys and values are separated by well defined delimiters. These delimeters are comma and colon characters.
65+
In this query, keys and values are separated by well defined delimiters. These delimeters are comma and colon characters.
6566

6667
:::moniker range="azure-data-explorer"
6768
> [!div class="nextstepaction"]
@@ -101,7 +102,7 @@ print str='src=10.1.1.123 dst=10.1.1.124 bytes=125 failure="connection aborted"
101102
|--|--|--|--|--|
102103
|2021-01-01 10:00:54.0000000| 10.1.1.123| 10.1.1.124| 125| connection aborted|
103104

104-
The following example uses different opening and closing quotes:
105+
This query uses different opening and closing quotes:
105106

106107
:::moniker range="azure-data-explorer"
107108
> [!div class="nextstepaction"]
@@ -221,7 +222,7 @@ print str="2021-01-01T10:00:34 [INFO] ThreadId:458745723, Machine:Node001, Text:
221222

222223
### Extraction using regex
223224

224-
When no delimiters define text structure well enough, regular expression-based extraction can be useful.
225+
When no delimiters define text structure enough, regular expression-based extraction can be useful.
225226

226227
:::moniker range="azure-data-explorer"
227228
> [!div class="nextstepaction"]

data-explorer/kusto/query/parse-operator.md

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: parse operator
33
description: Learn how to use the parse operator to parse the value of a string expression into one or more calculated columns.
44
ms.reviewer: alexans
55
ms.topic: reference
6-
ms.date: 08/11/2024
6+
ms.date: 01/22/2025
77
monikerRange: "microsoft-fabric || azure-data-explorer || azure-monitor || microsoft-sentinel "
88
---
99
# parse operator
@@ -37,7 +37,7 @@ Evaluates a string expression and parses its value into one or more calculated c
3737
> * If the parsed *expression* isn't of type `string`, it will be converted to type `string`.
3838
> * Use [`project`](project-operator.md) if you also want to drop or rename some columns.
3939
40-
### Supported kind values
40+
### Supported `kind` values
4141

4242
|Text|Description|
4343
|--|--|
@@ -67,9 +67,14 @@ The input table extended according to the list of columns that are provided to t
6767

6868
## Examples
6969

70+
The examples in this section show how to use the syntax to help you get started.
71+
72+
[!INCLUDE [help-cluster](../includes/help-cluster-note.md)]
73+
7074
The `parse` operator provides a streamlined way to `extend` a table by using multiple `extract` applications on the same `string` expression. This result is useful, when the table has a `string` column that contains several values that you want to break into individual columns. For example, a column that's produced by a developer trace ("`printf`"/"`Console.WriteLine`") statement.
7175

7276
### Parse and extend results
77+
7378
In the following example, the column `EventText` of table `Traces` contains
7479
strings of the form `Event: NotifySliceRelease (resourceName={0}, totalSlices={1}, sliceNumber={2}, lockTime={3}, releaseTime={4}, previousLockTime={5})`.
7580
The operation extends the table with six columns: `resourceName`, `totalSlices`, `sliceNumber`, `lockTime`, `releaseTime`, and `previousLockTime`.

data-explorer/kusto/query/parse-where-operator.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: parse-where operator
33
description: Learn how to use the parse-where operator to parse the value of a string expression into one or more calculated columns.
44
ms.reviewer: alexans
55
ms.topic: reference
6-
ms.date: 08/11/2024
6+
ms.date: 01/20/2025
77
---
88
# parse-where operator
99

@@ -70,6 +70,10 @@ The input table, which is extended according to the list of columns that are pro
7070
7171
## Examples
7272

73+
The examples in this section show how to use the syntax to help you get started.
74+
75+
[!INCLUDE [help-cluster](../includes/help-cluster-note.md)]
76+
7377
The `parse-where` operator provides a streamlined way to `extend` a table by using multiple `extract` applications on the same `string` expression. This is most useful when the table has a `string` column that contains several values that you want to break into individual columns. For example, you can break up a column that was produced by a developer trace ("`printf`"/"`Console.WriteLine`") statement.
7478

7579
### Using `parse`

data-explorer/kusto/query/partition-operator.md

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,15 @@ title: partition operator
33
description: Learn how to use the partition operator to partition the records of the input table into multiple subtables.
44
ms.reviewer: alexans
55
ms.topic: reference
6-
ms.date: 08/11/2024
6+
ms.date: 01/22/2025
77
---
88
# partition operator
99

1010
> [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)]
1111
1212
The partition operator partitions the records of its input table into multiple subtables according to values in a key column. The operator runs a subquery on each subtable, and produces a single output table that is the union of the results of all subqueries.
1313

14-
This operator is useful when you need to perform a subquery only on a subset of rows that belongs to the same partition key, and not query the whole dataset. These subqueries could include aggregate functions, window functions, top *N* and others.
14+
The partition operator is useful when you need to perform a subquery only on a subset of rows that belong to the same partition key, and not a query of the whole dataset. These subqueries could include aggregate functions, window functions, top *N* and others.
1515

1616
The partition operator supports several strategies of subquery operation:
1717

@@ -36,16 +36,16 @@ The partition operator supports several strategies of subquery operation:
3636
| *Column*| `string` | :heavy_check_mark: | The name of a column in *T* whose values determine how to partition the input tabular source.|
3737
| *TransformationSubQuery*| `string` | :heavy_check_mark: | A tabular transformation expression. The source is implicitly the subtables produced by partitioning the records of *T*. Each subtable is homogenous on the value of *Column*.</br></br> The expression must provide only one tabular result and shouldn't have other types of statements, such as `let` statements.|
3838
| *SubQueryWithSource*| `string` | :heavy_check_mark: | A tabular expression that includes its own tabular source, such as a table reference. This syntax is only supported with the [legacy strategy](#legacy-strategy). The subquery can only reference the key column, *Column*, from *T*. To reference the column, use the syntax `toscalar(`*Column*`)`.</br></br> The expression must provide only one tabular result and shouldn't have other types of statements, such as `let` statements.|
39-
| *Hints*| `string` | | Zero or more space-separated parameters in the form of: *HintName* `=` *Value* that control the behavior of the operator. See the [supported hints](#supported-hints) per strategy type.
39+
| *Hints*| `string` | | Zero or more space-separated parameters in the form of: *HintName* `=` *Value* that control the behavior of the operator. See the [supported hints](#supported-hints) per strategy type.|
4040

4141
### Supported hints
4242

4343
|Hint name|Type|Strategy|Description|
4444
|--|--|--|--|
4545
|`hint.shufflekey`| `string` | [shuffle](#shuffle-strategy) | The partition key used to run the partition operator with the `shuffle` strategy. |
46-
|`hint.materialized`| `bool` | [legacy](#legacy-strategy) | If set to `true`, will materialize the source of the `partition` operator. The default value is `false`. |
46+
|`hint.materialized`| `bool` | [legacy](#legacy-strategy) | If set to `true`, materializes the source of the `partition` operator. The default value is `false`. |
4747
|`hint.concurrency`| `int` | [legacy](#legacy-strategy) | Determines how many partitions to run in parallel. The default value is `16`.|
48-
|`hint.spread`| `int` | [legacy](#legacy-strategy) | Determines how to distribute the partitions among cluster nodes. The default value is `1`.</br></br> For example, if there are *N* partitions and the spread hint is set to *P*, then the *N* partitions will be processed by *P* different cluster nodes equally in parallel/sequentially depending on the concurrency hint.|
48+
|`hint.spread`| `int` | [legacy](#legacy-strategy) | Determines how to distribute the partitions among cluster nodes. The default value is `1`.</br></br> For example, if there are *N* partitions and the spread hint is set to *P*, then the *N* partitions are processed by *P* different cluster nodes equally, in parallel/sequentially depending on the concurrency hint.|
4949

5050
## Returns
5151

@@ -120,10 +120,14 @@ If the subquery is a tabular transformation without a tabular source, the source
120120
To use this strategy, specify `hint.strategy=legacy` or omit any other strategy indication.
121121

122122
> [!NOTE]
123-
> An error will occur if the partition column, *Column*, contains more than 64 distinct values.
123+
> An error occurs if the partition column, *Column*, contains more than 64 distinct values.
124124
125125
## Examples
126126

127+
The examples in this section show how to use the syntax to help you get started.
128+
129+
[!INCLUDE [help-cluster](../includes/help-cluster-note.md)]
130+
127131

128132
### Find top values
129133

@@ -144,7 +148,7 @@ StormEvents
144148
)
145149
```
146150

147-
**Output**
151+
**Output**
148152

149153
|EventType|State|Events|Injuries|
150154
|---|---|---|---|
@@ -180,7 +184,7 @@ StormEvents
180184
)
181185
```
182186

183-
**Output**
187+
**Output**
184188

185189
|EventType|TotalInjueries|
186190
|---|---|
@@ -212,7 +216,7 @@ StormEvents
212216
| count
213217
```
214218

215-
**Output**
219+
**Output**
216220

217221
|Count|
218222
|---|
@@ -238,7 +242,7 @@ range x from 1 to 2 step 1
238242
| count
239243
```
240244

241-
**Output**
245+
**Output**
242246

243247
|Count|
244248
|---|

data-explorer/kusto/query/pattern-statement.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,13 +56,14 @@ For more information, see [Working with middle-tier applications](#work-with-mid
5656
| *PathArgType* | `string` | | The type of the *PathArgType* argument. Possible values: `string` |
5757
| *ArgValue* | `string` | :heavy_check_mark: | The *ArgName* and optional *PathName* tuple values to be mapped to an *expression*. |
5858
| *PathValue* | `string` | | The value to map for *PathName*. |
59-
| *expression* | `string` | :heavy_check_mark: | A tabular or lambda expression that references a function returning tabular data. For example: `Logs | where Timestamp > ago(1h)` |
59+
| *expression* | `string` | :heavy_check_mark: | A tabular or lambda expression that references a function returning tabular data. For example: `Logs | where Timestamp > ago(1h)`|
6060

6161
## Examples
6262

63+
The examples in this section show how to use the syntax to help you get started.
64+
6365
[!INCLUDE [help-cluster](../includes/help-cluster-note.md)]
6466

65-
In these examples, a pattern is defined.
6667

6768
### Define a simple pattern
6869

data-explorer/kusto/query/print-operator.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
2-
title: print operator
2+
title: print operator
33
description: Learn how to use the print operator to output a single row with one or more scalar expression results as columns.
44
ms.reviewer: alexans
55
ms.topic: reference
6-
ms.date: 11/20/2024
6+
ms.date: 01/20/2025
77
---
88
# print operator
99

@@ -30,6 +30,10 @@ A table with one or more columns and a single row. Each column returns the corre
3030

3131
## Examples
3232

33+
The examples in this section show how to use the syntax to help you get started.
34+
35+
[!INCLUDE [help-cluster](../includes/help-cluster-note.md)]
36+
3337
### Print sum and variable value
3438

3539
The following example outputs a row with two columns. One column contains the sum of a series of numbers and the other column contains the value of the variable, `x`.

data-explorer/kusto/query/query-parameters-statement.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ To reference query parameters, the query text, or functions it uses, must first
3434
|Name|Type|Required|Description|
3535
|--|--|--|--|
3636
|*Name1*| `string` | :heavy_check_mark:|The name of a query parameter used in the query.|
37-
|*Type1*| `string` | :heavy_check_mark:|The corresponding type, such as `string` or `datetime`. The values provided by the user are encoded as strings. The appropriate parse method is applied to the query parameter to get a strongly-typed value.|
37+
|*Type1*| `string` | :heavy_check_mark:|The corresponding type, such as `string` or `datetime`. The values provided by the user are encoded as strings. The appropriate parse method is applied to the query parameter to get a strongly typed value.|
3838
|*DefaultValue1*| `string` ||A default value for the parameter. This value must be a literal of the appropriate scalar type.|
3939

4040
> [!NOTE]
@@ -44,8 +44,14 @@ To reference query parameters, the query text, or functions it uses, must first
4444
4545
## Example
4646

47+
The examples in this section show how to use the syntax to help you get started.
48+
4749
[!INCLUDE [help-cluster](../includes/help-cluster-note.md)]
4850

51+
### Declare query parameters
52+
53+
This query retrieves storm events from the *StormEvents* table where the total number of direct and indirect injuries exceeds a specified threshold (default is 90). It then projects the *EpisodeId*, *EventType*, and the total number of injuries for each of these events.
54+
4955
:::moniker range="azure-data-explorer"
5056
> [!div class="nextstepaction"]
5157
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA4WNuw7CMBAE+0j5hytBpKAFBBUpXEOPrHgFjvzifAEi8fEkQUBJO9qZNWicZtC1A/enpFl7CDjPvH6o0HYMs3YxnGlLq+V8UxYHiezrG4JkKosn3S8Y9GlqkfeW0QgtvkAF80Y7+hVHL3FsR14nm6OBMhVN1WOfUJFE0e7TGL7/9l+H314eyAAAAA==" target="_blank">Run the query</a>

data-explorer/kusto/query/range-operator.md

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: range operator
33
description: Learn how to use the range operator to generate a single-column table of values.
44
ms.reviewer: alexans
55
ms.topic: reference
6-
ms.date: 01/07/2025
6+
ms.date: 01/22/2025
77
---
88
# range operator
99

@@ -26,7 +26,7 @@ Generates a single-column table of values.
2626
|--|--|--|--|
2727
|*columnName*| `string` | :heavy_check_mark:| The name of the single column in the output table.|
2828
|*start*|int, long, real, datetime, or timespan| :heavy_check_mark:| The smallest value in the output.|
29-
|*stop*|int, long, real, datetime, or timespan| :heavy_check_mark:| The highest value being generated in the output or a bound on the highest value if *step* steps over this value.|
29+
|*stop*|int, long, real, datetime, or timespan| :heavy_check_mark:| The highest value being generated in the output or a bound on the highest value if *step* is over this value.|
3030
|*step*|int, long, real, datetime, or timespan| :heavy_check_mark:| The difference between two consecutive values.|
3131

3232
> [!NOTE]
@@ -39,6 +39,10 @@ whose values are *start*, *start* `+` *step*, ... up to and until *stop*.
3939

4040
## Examples
4141

42+
The example in this section shows how to use the syntax to help you get started.
43+
44+
[!INCLUDE [help-cluster](../includes/help-cluster-note.md)]
45+
4246
### Range over the past seven days
4347

4448
The following example creates a table with entries for the current time stamp extended over the past seven days, once a day.
@@ -114,13 +118,13 @@ let MyTimeline = range MyMonthHour from MyMonthStart to now() step StepBy
114118

115119
**Output**
116120

117-
| MyMonthHour | MyMonthHourinUnixTime | DateOnly | TimeOnly |
118-
|--------------|------------------------|---------------|------------------------------|
119-
| 2023-02-01 | 00:00:00.0000000 | 1675209600 | 2023-02-01 00:00:00.0000000 |
120-
| 2023-02-01 | 04:32:02.4000000 | 1675225922.4 | 2023-02-01 00:00:00.0000000 |
121-
| 2023-02-01 | 09:04:04.8000000 | 1675242244.8 | 2023-02-01 00:00:00.0000000 |
122-
| 2023-02-01 | 13:36:07.2000000 | 1675258567.2 | 2023-02-01 00:00:00.0000000 |
123-
| ... | ... | ... | ... |
121+
| MyMonthHour | MyMonthHourinUnixTime | DateOnly | TimeOnly |
122+
|--|--|--|--|
123+
| 2023-02-01 | 00:00:00.0000000 | 1675209600 | 2023-02-01 00:00:00.0000000 |
124+
| 2023-02-01 | 04:32:02.4000000 | 1675225922.4 | 2023-02-01 00:00:00.0000000 |
125+
| 2023-02-01 | 09:04:04.8000000 | 1675242244.8 | 2023-02-01 00:00:00.0000000 |
126+
| 2023-02-01 | 13:36:07.2000000 | 1675258567.2 | 2023-02-01 00:00:00.0000000 |
127+
| ... | ... | ... | ... |
124128

125129
### Incremented steps
126130

@@ -134,16 +138,19 @@ whose type is `long` and results in values from one to eight incremented by thre
134138

135139
```kusto
136140
range Steps from 1 to 8 step 3
141+
```
142+
143+
**Output**
137144

138145
| Steps |
139-
|-------|
140-
| 1 |
141-
| 4 |
142-
| 7 |
146+
|--|
147+
| 1 |
148+
| 4 |
149+
| 7 |
143150

144151
### Traces over a time range
145152

146-
The following example shows how the `range` operator can be used to create a dimension table that is used to introduce zeros where the source data has no values. It takes timestamps from the last four hours and counts traces for each one minute interval. When there are no traces for a specific interval, the count is zero.
153+
The following example shows how the `range` operator can be used to create a dimension table that is used to introduce zeros where the source data has no values. It takes timestamps from the last four hours and counts traces for each one-minute interval. When there are no traces for a specific interval, the count is zero.
147154

148155
```kusto
149156
range TIMESTAMP from ago(4h) to now() step 1m

0 commit comments

Comments
 (0)