diff --git a/data-explorer/kusto/query/assessment.md b/data-explorer/kusto/query/assessment.md index cef64cf547..152421cd01 100644 --- a/data-explorer/kusto/query/assessment.md +++ b/data-explorer/kusto/query/assessment.md @@ -1,41 +1,37 @@ --- -title: Writing assessment +title: Writing Assessment description: This article is for writing assessment purposes only. -ms.reviewer: orspod +ms.reviewer: Yuri Kruman ms.topic: reference -ms.date: 08/11/2024 +ms.date: 2024-12-05 --- -# Kusto Query Language -Kusto Query Language is a powerful tool to explore your data and discover patterns, identify anomalies and outliers, create statistical modeling, etc. -You can query different kinds of data. The language is expressive, easy to read and understand the query intent, and optimized for authoring experiences. Kusto Query Language is optimal for querying telemetry, metrics, and logs with deep support for text search and parsing, time-series operators and functions, analytics and aggregation, geospatial, vector similarity searches, and many other language constructs that provide the most optimal language for data analysis. The query uses schema entities that are organized in a hierarchy similar to SQLs: databases, tables, and columns. +Kusto Query Language (KQL) is a powerful tool to explore your data and discover patterns, identify anomalies and outliers, create statistical modeling, and analyze complex datasets. You can query different kinds of data using this versatile language. KQL is expressive, easy to read, and optimized for authoring experiences, making query intent clear and understandable. -This article provides an explanation of the query language and offers practical exercises to get you started writing queries. To access the query environment, use the [Azure Data Explorer web UI](https://dataexplorer.azure.com/). To learn how to use KQL, see [Tutorial: Learn common operators](tutorials/learn-common-operators.md). +KQL excels at querying telemetry, metrics, and logs with deep support for text search and parsing, time-series operators and functions, analytics and aggregation, geospatial operations, vector similarity searches, and many other language constructs that provide optimal data analysis capabilities. The query system uses schema entities organized in a hierarchy similar to SQL: databases, tables, and columns. -The most common kind of query statement is a tabular expression **statement**, which means both its input and output consist of tables or tabular datasets. Tabular statements contain zero or more **operators**, each of which starts with a tabular input and returns a tabular output. Operators are sequenced by a `|` (pipe). Data flows, or is piped, from one operator to the next. The data is filtered or manipulated at each step and then fed into the following step. +To access the query environment, use [Azure Data Explorer web UI](https://dataexplorer.azure.com/). -A Kusto query is a read-only request to process data and return results. The request is stated in plain text, using a data-flow model that is easy to read, author, and automate. Kusto queries are made of one or more query statements. +To learn how to use KQL, see [Tutorial: Learn common operators](tutorials/learn-common-operators.md). -There are two kinds of user [query statements](statements.md): +##Query Structure and Operation +The most common kind of query statement is a tabular expression statement, where both input and output consist of tables or tabular datasets. These statements contain zero or more operators, each starting with tabular input and returning tabular output. Operators are sequenced by a `|` (pipe). Data flows through each operator, being filtered or manipulated at each step before moving to the next. -1. A [tabular expression statement](tabular-expression-statements.md) -1. A [let statement](let-statement.md) -1. A [set statement](set-statement.md) +It functions like a funnel, where you start with an entire data table. Each time the data passes through another operator, it's filtered, rearranged, or summarized. The query operator order is important and can affect both results and performance. At the end of the funnel, you're left with a refined output. -All query statements are separated by a `;` (semicolon), and only affect the query at hand. +A Kusto query is a read-only request to process data and return results. The request is stated in plain text, using a data-flow model that is easy to read, author and automate. Kusto queries are made of one or more query statements. -For information about application query statements, see [Application query statements](statements.md#application-query-statements). +All query statements are separated by a semicolon (`;`) and only affect the query at hand. +For more on application query statements, see [Application query statements](statements.md#application-query-statements). -It's like a funnel, where you start out with an an entire data table. Each time the data passes through another operator, it's filtered, rearranged, or summarized. Because the piping of information from one operator to another is sequential, the query operator order is important, and can affect both results and performance. At the end of the funnel, you're left with a refined output. - -Why don't you see an example query. +Here's a query example: > [!div class="nextstepaction"] > Run the query ```kusto -StormEvents +_StormEvents_ | where StartTime between (datetime(2007-11-01) .. datetime(2007-12-01)) | where State == "florida" | count @@ -45,35 +41,46 @@ StormEvents |-----| | 28| -Did you no, KQL is case-sensitive for everything – table names, table column names, operators, functions, and so on. +Note that KQL is case-sensitive for everything, including table names, column names, operators, functions, and all other elements. + +There are three types of user query statements [query statements](statements.md): + + 1. A [tabular expression statement](tabular-expression-statements.md) + 2. A [let statement](let-statement.md) + 3. A [set statement](set-statement.md) + +The above query has a single tabular expression statement. The statement begins with a reference to a table called *StormEvents* and contains several operators, [`where`](where-operator.md) and [`count`](count-operator.md), each separated by a pipe. + +The data rows for the source table are filtered by the value of the *StartTime* column and then filtered by the value of the *State* column. In the last line, the query returns a table with a single column and a single row containing the count of the remaining rows. -This query has a single tabular expression statement. The statement begins with a reference to a table called *StormEvents* and contains several operators, [`where`](where-operator.md) and [`count`](count-operator.md), each separated by a pipe. The data rows for the source table are filtered by the value of the *StartTime* column and then filtered by the value of the *State* column. In the last line, the query returns a table with a single column and a single row containing the count of the remaining rows. +##Management Commands +In contrast to Kusto queries, management commands are requests to Kusto to process or modify data or metadata. -In contrast to Kusto queries, [Management commands](../management/index.md are requests to Kusto to process or modify data or metadata. For example, the following management command creates a new Kusto table with two columns, `Level` and `Number`: +For example, the following example creates a new Kusto table with two columns: ```kusto .create table Logs (Level:string, Text:string) ``` -Management commands have their own syntax, which isn't part of the Kusto Query Language syntax, although the two share many concepts. In particular, management comands are distinguished from queries by having the first character in the text of the command be the dot (`.`) character (which can't start a query). Why do we do it like this? This distinction prevents many kinds of security attacks, simply because it prevents embedding management commands inside queries. +Management commands have their own syntax, distinct from KQL syntax, although they share many concepts. These commands are distinguished at the beginning with a dot (`.`), which prevents management commands from being embedded inside queries and enhances security. -Not all management commands modify data or metadata. The large class of commands that start with `.show`, are used to display metadata or data. For example, the `.show tables` command returns a list of all tables in the current database. +Not all management commands modify data or metadata. Commands that start with `.show` display metadata or data. For example, `.show` tables returns a list of all tables in the current database. -For more information on management commands, see [Management commands overview](../management/index.md). +For more, see [Management commands overview](../management/index.md). -## KQL in other services +##KQL in Other Services -KQL is used by many other Microsoft services. For specific information on the use of KQL in these environments, refer to the following links: +KQL is implemented across many Microsoft services. For specific information about using KQL in these environments, refer to: -[Log queries in Azure Monitor](/azure/azure-monitor/logs/log-query-overview) -[Kusto Query Language in Microsoft Sentinel](/azure/sentinel/kusto-overview) -[Understanding the Azure Resource Graph query language](/azure/governance/resource-graph/concepts/query-language) -[Proactively hunt for threats with advanced hunting in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-overview) -[CMPivot queries](/mem/configmgr/core/servers/manage/cmpivot-overview#queries) +* [Log queries in Azure Monitor](/azure/azure-monitor/logs/log-query-overview) +* [Kusto Query Language in Microsoft Sentinel](/azure/sentinel/kusto-overview) +* [Understanding the Azure Resource Graph query language](/azure/governance/resource-graph/concepts/query-language) +* [Advanced hunting for threats in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-overview) +* [CMPivot queries](/mem/configmgr/core/servers/manage/cmpivot-overview#queries) -## Related stuff +##Related Resources -* [Tytorial: Learn common operators](tutorials/learn-common-operators.md) +* [Tutorial: Learn common operators](tutorials/learn-common-operators.md) * [Tutorial: Use aggregation functions](tutorials/use-aggregation-functions.md) * [KQL quick reference](kql-quick-reference.md) * [SQL to Kusto Query Language cheat sheet](sql-cheat-sheet.md)