Merge pull request #6367 from MicrosoftDocs/main

sync release

Author: YaelSchuster

.openpublishing.build.ps1

@@ -429,6 +429,11 @@
       "source_path": "excel-connector.md",
       "redirect_url": "/azure/data-explorer/excel",
       "redirect_document_id": false
+    },
+    {
+      "source_path": "query-exported-azure-monitor-data.md",
+      "redirect_url": "/azure/data-explorer/query-monitor-data",
+      "redirect_document_id": false
     }
   ]
 }

data-explorer/.openpublishing.redirection.json

@@ -9,7 +9,7 @@ ms.date: 06/04/2024
 
 [Azure Event Hubs](/azure/event-hubs/event-hubs-about) is a big data streaming platform and event ingestion service. Azure Data Explorer offers continuous ingestion from customer-managed Event Hubs.
 
-The Event Hubs ingestion pipeline transfers events to Azure Data Explorer in several steps. First you create an event hub in the Azure portal. Then create a target table in Azure Data Explorer into which the [data in a particular format](#data-format), is ingested using the provided [ingestion properties](#ingestion-properties). The Event Hubs connection needs to be aware of [events routing](#events-routing). Data may be embedded with selected properties according to the [event system properties](#event-hubs-system-properties-mapping). Create a connection to Event Hubs to [create an event hub](#create-an-event-hub) and [send events](#send-events). This process can be managed through the [Azure portal](create-event-hubs-connection.md?tabs=portalADX), programmatically with [C#](create-event-hubs-connection-sdk.md?tabs=c-sharp) or [Python](create-event-hubs-connection-sdk.md?tabs=python), or with the [Azure Resource Manager template](create-event-hubs-connection.md?tabs=arm-template).
+The Event Hubs ingestion pipeline transfers events to Azure Data Explorer in several steps. First you create an event hub in the Azure portal. Then create a target table in Azure Data Explorer into which the [data in a particular format](#data-format), is ingested using the provided [ingestion properties](#ingestion-properties). The Event Hubs connection needs to be aware of [events routing](#events-routing). Data may be embedded with selected properties according to the [event system properties](#event-hubs-system-properties-mapping). Create a connection to Event Hubs to [create an event hub](#create-event-hubs) and [send events](#send-events). This process can be managed through the [Azure portal](create-event-hubs-connection.md?tabs=portalADX), programmatically with [C#](create-event-hubs-connection-sdk.md?tabs=c-sharp) or [Python](create-event-hubs-connection-sdk.md?tabs=python), or with the [Azure Resource Manager template](create-event-hubs-connection.md?tabs=arm-template).
 
 For general information about data ingestion in Azure Data Explorer, see [Azure Data Explorer data ingestion overview](ingest-data-overview.md).
 
@@ -190,12 +190,7 @@ You can use one of the following methods to embed custom properties into the dat
 * Use Azure Stream Analytics to [process events from the event hub and embed the custom properties](/azure/event-hubs/process-data-azure-stream-analytics) in the event data. From Azure Stream Analytics you can ingest the data natively using the [Azure Data Explorer output connector](/azure/stream-analytics/azure-database-explorer-output), or route the data into another event hub and from there into your cluster.
 * Use [Azure Functions](/azure/azure-functions/functions-overview) to add the custom properties and then ingest the data.
 
-## Cross-region Event Hubs data connection
-
-For best performance, create all the following resources in the same region as the cluster.
-If there is no other alternative, consider using [Premium](/azure/event-hubs/event-hubs-premium-overview) or [Dedicated](/azure/event-hubs/event-hubs-dedicated-overview) Event Hubs tiers. Event Hubs tiers comparison can be found [here](/azure/event-hubs/compare-tiers).
-
-### Create an event hub
+## Create Event Hubs
 
 If you don't already have one, [Create an event hub](/azure/event-hubs/event-hubs-create). Connecting to event hub can be managed through the [Azure portal](create-event-hubs-connection.md?tabs=portalADX), programmatically with [C#](create-event-hubs-connection-sdk.md?tabs=c-sharp) or [Python](create-event-hubs-connection-sdk.md?tabs=python), or with the [Azure Resource Manager template](create-event-hubs-connection.md?tabs=arm-template).
 
@@ -204,10 +199,18 @@ If you don't already have one, [Create an event hub](/azure/event-hubs/event-hub
 > * The ability to dynamically add partitions after creating an event hub is only available with Event Hubs Premium and Dedicated tiers. Consider the long-term scale when setting partition count.
 > * Consumer group *must* be unique per consumer. Create a consumer group dedicated to Azure Data Explorer connection.
 
-### Send events
+### Cross-region Event Hubs data connection
+
+For best performance, create the event hub in the same region as the cluster. If this is not possible, consider using [Premium](/azure/event-hubs/event-hubs-premium-overview) or [Dedicated](/azure/event-hubs/event-hubs-dedicated-overview) Event Hubs tiers. For a comparison of tiers, see [Compare Azure Event Hubs tiers](/azure/event-hubs/compare-tiers).
+
+## Send events
 
 See the [sample app](https://github.com/Azure-Samples/event-hubs-dotnet-ingest) that generates data and sends it to an event hub.
 
+> [!NOTE]
+> 
+> To enable efficient processing of events from Event Hubs to Azure Data Explorer, avoid an unbalanced distribution of events across partitions. Uneven mapping can cause a high [discovery latency](/azure/data-explorer/using-metrics#ingestion-metrics). For more information, see [Mapping of events to partitions](/azure/event-hubs/event-hubs-features#mapping-of-events-to-partitions).
+
 ## Set up Geo-disaster recovery solution
 
 Event hub offers a [Geo-disaster recovery](/azure/event-hubs/event-hubs-geo-dr) solution.

data-explorer/ingest-data-event-hub-overview.md

@@ -41,6 +41,7 @@ For more information, see [management commands for managing the Row Level Securi
   * When it's referenced by an [update policy](update-policy.md) query, while the update policy is not configured with a managed identity.
   * When it's referenced by a [continuous export](../management/data-export/continuous-data-export.md) that uses an authentication method other than impersonation.
   * When a [restricted view access policy](restricted-view-access-policy.md) is configured for the table.
+* The RLS query can't reference tables located in other databases.
 
 ## Examples
 

data-explorer/kusto/management/row-level-security-policy.md

@@ -0,0 +1,124 @@
+---
+title: graph-mark-components operator (Preview)
+description: Learn how to use the graph-mark-components operator to find and mark all connected components of a graph.
+ms.reviewer: royo
+ms.topic: reference
+ms.date: 11/06/2024
+---
+# graph-mark-components operator (Preview)
+
+> [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)]
+
+The `graph-mark-components` operator finds all connected components of a graph and marks each node with a component identifier.
+
+> [!NOTE]
+> This operator is used in conjunction with the [make-graph operator](make-graph-operator.md).
+
+## Syntax
+
+*G* `|` `graph-mark-components` [`kind` `=` *Kind*] [`with_component_id` `=` *ComponentId*]
+
+## Parameters
+
+| Name | Type | Required | Description |
+|--|--|--|--|
+| *G* | string |  :heavy_check_mark: | The graph source. |
+| *Kind* | string |  | The connected component kind, either `weak` (default) or `strong`. A weak component is a set of nodes connected by a path, ignoring the direction of edges. A strong component is a set of nodes connected in both directions, considering the edges' directions. |
+| *ComponentId* | string |  | The property name that denotes the component identifier. The default property name is `ComponentId`. |
+
+## Returns
+
+The `graph-mark-components` operator returns a *graph* result, where each node has a component identifier in the *ComponentId* property. The identifier is a zero-based consecutive index of the components. Each component index is chosen arbitrarily and might not be consistent across runs.
+
+## Examples
+
+### Find families by their relationships
+
+The following example creates a graph from a set of child-parent pairs and identifies connected components using a `family` identifier.
+
+:::moniker range="azure-data-explorer"
+> [!div class="nextstepaction"]
+> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA2WQ24rCMBCG7%2FMUQ65caF5AccGzILIPsCwyNrENzaFMw4qwD79pNLUiuUj%2Bb77JxW9UgFWtjfy6wBwkhnjORk3Knk27QNpVBbRIyoVH%2FAD2DQyAL4wuFS%2BAL%2F05XomtkLzpWR6%2B0jX%2BDnBHqnozMxyLe39Fkm%2FqE4%2FlTXryLaFrMsuBH9EYTzdejMyDpjhjPzNguQj2BxYbJSrCtoZUBQjx%2BagBrjrUJ%2BelOmk5d2hV9JMqLFIjSm9b76LY3c0hRz12fEGrzW1YCV6kxqH%2FsPsH1QoVAI8BAAA%3D" target="_blank">Run the query</a>
+::: moniker-end
+
+```kusto
+let ChildOf = datatable(child:string, parent:string) 
+[ 
+  "Alice", "Bob",  
+  "Carol", "Alice",  
+  "Carol", "Dave",  
+  "Greg", "Alice",  
+  "Greg", "Dave",  
+  "Howard", "Alice",  
+  "Howard", "Dave",  
+  "Eve", "Frank",  
+  "Frank", "Mallory",
+  "Eve", "Kirk",
+]; 
+ChildOf 
+| make-graph child --> parent with_node_id=name
+| graph-mark-components with_component_id = family
+| graph-to-table nodes
+```
+
+**Output**
+
+|name|family|
+|---|---|
+|Alice|0|
+|Bob|0|
+|Carol|0|
+|Dave|0|
+|Greg|0|
+|Howard|0|
+|Eve|1|
+|Frank|1|
+|Mallory|1|
+|Kirk|1|
+
+### Find a greatest common ancestor for each family
+
+The following example uses the connected component `family` identifier and the `graph-match` operator to identify the greatest ancestor of each family in a set of child-parent data.
+
+:::moniker range="azure-data-explorer"
+> [!div class="nextstepaction"]
+> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA2WQy07DQAxF9%2FkKK6sEJZFYsAG1EpSXhBAfUFWVO%2BMmQ%2BYROQMliI9nkiYlqJqFx9fHvpY1eVhVSsu3PSxAog9vpykRvXbdela2zKBBJuvHNIVoDRFAfKuVoDiD%2BM7tQhi0FbLTvTYV%2F6v3%2BHkSn5jKM3IS5%2BCzOyDLM%2FRPnsMPwzd%2BZLT1pE1J%2FIpaO%2B7ibEa%2BKA61aHMD0XSI6AcM1pSXjE0Fwykgz5fjGeCgfLW1TtJWyYVFQ4Ef0Nwg17lwpnE2gO2RPOUBDzfeo1G6m7V4UUEiqRVkJVqf5mtx3OPisiiuNvkyQSuo9Y7TsHbD7p2Eh943TJtKRZ9noJUlLPvCOKMYYja6zhtOe7QfJuytvgmSkiwxeuVsmw0Oad%2FBpcGvBJmx22qypa%2BS0SfNjtCuGw1%2BAcTWyMtPAgAA" target="_blank">Run the query</a>
+::: moniker-end
+
+```kusto
+let ChildOf = datatable(child:string, parent:string) 
+[ 
+  "Alice", "Bob",  
+  "Carol", "Alice",  
+  "Carol", "Dave",  
+  "Greg", "Alice",  
+  "Greg", "Dave",  
+  "Howard", "Alice",  
+  "Howard", "Dave",  
+  "Eve", "Frank",  
+  "Frank", "Mallory",
+  "Eve", "Kirk",
+]; 
+ChildOf 
+| make-graph child --> parent with_node_id=name
+| graph-mark-components with_component_id = family
+| graph-match (descendant)-[childOf*1..5]->(ancestor)
+  project name = ancestor.name, lineage = childOf.child, family = ancestor.family
+| summarize (generations, name) = argmax(array_length(lineage),name) by family
+```
+
+**Output**
+
+|family|generations|name|
+|---|---|---|
+|1|2|Mallory|
+|0|2|Bob|
+
+## Related content
+
+* [Best practices for Kusto Query Language (KQL) graph semantics](graph-best-practices.md)
+* [Graph operators](graph-operators.md)
+* [make-graph operator](make-graph-operator.md)
+* [graph-match operator](graph-match-operator.md)
+* [graph-to-table operator](graph-to-table-operator.md)
+

data-explorer/kusto/query/graph-mark-components-operator.md

@@ -3,7 +3,7 @@ title: Graph operators
 description: Learn how to use KQL graph operators.
 ms.reviewer: alexans
 ms.topic: reference
-ms.date: 08/11/2024
+ms.date: 11/05/2024
 ---
 # Graph operators
 
@@ -28,6 +28,8 @@ The following table describes the supported graph operators.
 | [make-graph](make-graph-operator.md) | Builds a graph from tabular data. |
 | [graph-match](graph-match-operator.md) | Searches for patterns in a graph. |
 | [graph-to-table](graph-to-table-operator.md) | Builds nodes or edges tables from a graph. |
+| [graph-shortest-paths](graph-shortest-paths-operator.md) | Finds the shortest paths from a given set of source nodes to a set of target nodes. |
+| [graph-mark-components](graph-mark-components-operator.md) | Finds and marks all connected components. |
 
 ## Graph model