diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index b6c2fc9773..fb49faa788 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,28 +1,20 @@ -# Thank you for contributing to Azure Data Explorer documentation +# Thank you for contributing to Kusto documentation -## Fill out these items before submitting your pull request: +Please add a brief comment outlining the purpose of this PR. Add links to any relevant references such as DevOps work items. -If you are working internally at Microsoft: +## Make sure you've done the following: -- **Provide a link to an Azure DevOps Boards work item that tracks this feature/update.** +1. **Acrolinx:** Make sure your Acrolinx score is **at least 80** (higher is better) and with **0** spelling issues. +1. **Successful build**: Review the build status to make sure **all files are green** (Succeeded) and there are no errors, warnings, or suggestions. +1. **Preview the pages:**: Click each **Preview URL** link, scan the entire page looking for formatting issues, in particular the parts you edited. +1. **Check the Table of Contents:** If you are adding a new markdown file, make sure it is linked from the table of contents. +1. **Sign off**: Once the PR is finalized, add a comment with `#sign-off` . If you need to cancel the sign-off, add a comment with `#hold-off`. -- **Who is your Docs team contact?** \@mention them individually tag them and let them review the PR before signing off. + **NOTE**: *Signing off means the document can be published at any time.* -## For internal Microsoft contributors, check off these quality control items as you go +## Next steps -- [ ] 1. **Check the Acrolinx report:** Make sure your Acrolinx Total score is **above 80 minimum** (higher is better) and with no spelling issues. Acrolinx ensures we are providing consistent terminology and using an appropriate voice and tone, and helps with localization. +- All PRs to this repository are reviewed and merged by a human. Automatic merge is disabled on this repository for PRs, even with the qualifies-for-auto-merge label. +- Once all feedback on the PR is addressed, the PR will be merged into the main branch. -- [ ] 2. **Successful build with no warnings or suggestions**: Review the build status to make sure **all files are green** (Succeeded). - -- [ ] 3. **Preview the pages:**: Click each **Preview URL** link to view the rendered HTML pages on the review.learn.microsoft.com site to check the formatting and alignment of the page. Scan the page for overall formatting, and look at the parts you edited in detail. - -- [ ] 4. **Check the Table of Contents:** If you are adding a new markdown file, make sure it is linked from the table of contents. - -- [ ] 5. **#sign-off to request PR review and merge**: Once the pull request is finalized and ready to be merged, indicate so by typing `#sign-off` in a new comment in the Pull Request. If you need to cancel that sign-off, type `#hold-off` instead. *Signing off means the document can be published at any time.* Note, this is a formatting and standards review, not a technical review. - -## Merge and publish - -- After you `#sign-off`, there is a separate PR Review team that will review the PR and describe any necessary feedback before merging. -- The review team will use the comments section in the PR to provide feedback if changes are needed. Address any blocking issues and sign off again to request another review. -- Once all feedback is resolved, you can `#sign-off` again. The PR Review team reviews and merges the pull request into the specified branch (usually the *main( branch or a *release-branch*). -- From the *main* branch, the change is merged into the *live* branch several times a day to publish it to the public learn.microsoft.com site. +[Learn more about how to contribute](https://review.learn.microsoft.com/en-us/help/platform/?branch=main). diff --git a/data-explorer/kusto/includes/help-cluster-note.md b/data-explorer/kusto/includes/help-cluster-note.md new file mode 100644 index 0000000000..17018476f5 --- /dev/null +++ b/data-explorer/kusto/includes/help-cluster-note.md @@ -0,0 +1,11 @@ +--- +ms.topic: include +ms.date: 01/22/2025 +--- + +:::moniker range="azure-data-explorer" +> The examples in this article use publicly available tables in the [help cluster](https://dataexplorer.azure.com/clusters/help/), such as the `StormEvents` table in the *Samples* database. +::: moniker-end +:::moniker range="microsoft-fabric" +> The examples in this article use publicly available tables, such as the `StormEvents` table in the Weather analytics [sample data](/fabric/real-time-intelligence/sample-gallery). +::: moniker-end \ No newline at end of file diff --git a/data-explorer/kusto/query/alias-statement.md b/data-explorer/kusto/query/alias-statement.md index 0ce2adbd05..be3a78fb1b 100644 --- a/data-explorer/kusto/query/alias-statement.md +++ b/data-explorer/kusto/query/alias-statement.md @@ -3,7 +3,7 @@ title: Alias statement description: Learn how to use an alias statement to define an alias for a database that is used for a query. ms.reviewer: alexans ms.topic: reference -ms.date: 01/12/2025 +ms.date: 01/21/2025 --- # Alias statement @@ -11,47 +11,38 @@ ms.date: 01/12/2025 Alias statements allow you to define an alias for a database, which can be used in the same query. -:::moniker range="azure-data-explorer" -This is useful when you're working with several clusters but want to appear as if you're working on fewer clusters. -The alias must be defined according to the following syntax, where *clustername* and *databasename* are existing and valid entities. - - -## Syntax - -`alias` database *DatabaseAliasName* `=` cluster("https://*clustername*.kusto.windows.net").database("*DatabaseName*") -::: moniker-end - -:::moniker range="microsoft-fabric" -This is useful when you're working with several Eventhouses but want to appear as if you're working on fewer Eventhouses. -The alias must be defined according to the following syntax, where *Eventhouse* and *databasename* are existing and valid entities. +The `alias` statement is useful as a shorthand name for a database so it can be referenced using that alias in the same query. ## Syntax -`alias` database *DatabaseAliasName* `=` cluster("*serviceURL*").database("*DatabaseName*") -::: moniker-end +`alias` database *DatabaseAliasName* `=` cluster("QueryURI").database("*DatabaseName*") [!INCLUDE [syntax-conventions-note](../includes/syntax-conventions-note.md)] ## Parameters -|Name|Type|Required|Description| +| Name | Type | Required | Description | |--|--|--|--| -|*DatabaseAliasName*| `string` | :heavy_check_mark:|An existing name or new database alias name. You can escape the name with brackets. For example, ["Name with spaces"]. | -|*DatabaseName*| `string` | :heavy_check_mark:|The name of the database to give an alias.| +| *DatabaseAliasName* | `string` | :heavy_check_mark: | An existing name or new database alias name. You can escape the name with brackets. For example, ["Name with spaces"]. | +| *QueryURI* | `string` | :heavy_check_mark: | The URI that can be used to run queries or management commands. | +| *DatabaseName* | `string` | :heavy_check_mark: | The name of the database to give an alias. | :::moniker range="azure-data-explorer" > [!NOTE] -> The mapped cluster-uri and the mapped database-name must appear inside double-quotes(") or single-quotes('). +> +> - To get your Query URI, in the Azure portal, go to your cluster's overview page, and then copy the URI. +> - The mapped Query and the mapped database-name must appear inside double-quotes(") or single-quotes('). ::: moniker-end - :::moniker range="microsoft-fabric" > [!NOTE] -> The mapped Eventhouse-uri and the mapped database-name must appear inside double-quotes(") or single-quotes('). +> +> - To get your Query URI, see [Copy a KQL database URI](/fabric/real-time-intelligence/access-database-copy-uri#copy-uri). +> - The mapped Query and the mapped database-name must appear inside double-quotes(") or single-quotes('). ::: moniker-end ## Examples -[!INCLUDE [help-cluster](../includes/help-cluster-samples-stormevents.md)] +[!INCLUDE [help-cluster](../includes/help-cluster-note.md)] First, count the number of records in that table. diff --git a/data-explorer/kusto/query/as-operator.md b/data-explorer/kusto/query/as-operator.md index 5b58610235..ff925f9fbd 100644 --- a/data-explorer/kusto/query/as-operator.md +++ b/data-explorer/kusto/query/as-operator.md @@ -3,13 +3,13 @@ title: as operator description: Learn how to use the as operator to bind a name to the operator's input tabular expression. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 01/27/2025 --- # as operator > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Binds a name to the operator's input tabular expression. This allows the query to reference the value of the tabular expression multiple times without breaking the query and binding a name through the [let statement](let-statement.md). +Binds a name to the operator's input tabular expression. This operator allows the query to reference the value of the tabular expression multiple times without breaking the query and binding a name through the [let statement](let-statement.md). To optimize multiple uses of the `as` operator within a single query, see [Named expressions](named-expressions.md). @@ -25,42 +25,57 @@ To optimize multiple uses of the `as` operator within a single query, see [Named |--|--|--|--| |*T*| `string` | :heavy_check_mark: | The tabular expression to rename.| | *Name*| `string` | :heavy_check_mark: | The temporary name for the tabular expression.| -| *`hint.materialized`*| `bool` | | If *Materialized* is set to `true`, the value of the tabular expression will be as if it was wrapped by a [materialize()](materialize-function.md) function call. Otherwise, the value will be recalculated on every reference.| +| *`hint.materialized`*| `bool` | | If *Materialized* is set to `true`, the value of the tabular expression output is wrapped by a [materialize()](materialize-function.md) function call. Otherwise, the value is recalculated on every reference.| > [!NOTE] > -> * The name given by `as` will be used in the `withsource=` column of [union](union-operator.md), the `source_` column of [find](find-operator.md), and the `$table` column of [search](search-operator.md). +> * The name given by `as` is used in the `withsource=` column of [union](union-operator.md), the `source_` column of [find](find-operator.md), and the `$table` column of [search](search-operator.md). > * The tabular expression named using the operator in a [join](join-operator.md)'s outer tabular input (`$left`) can also be used in the join's tabular inner input (`$right`). ## Examples -In the following two examples the union's generated TableName column will consist of 'T1' and 'T2'. +In the following two examples, the generated TableName column consists of 'T1' and 'T2'. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] -> Run the query +> Run the query ::: moniker-end ```kusto -range x from 1 to 10 step 1 +range x from 1 to 5 step 1 | as T1 -| union withsource=TableName (range x from 1 to 10 step 1 | as T2) +| union withsource=TableName (range x from 1 to 5 step 1 | as T2) ``` Alternatively, you can write the same example as follows: :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] -> Run the query +> Run the query ::: moniker-end ```kusto -union withsource=TableName (range x from 1 to 10 step 1 | as T1), (range x from 1 to 10 step 1 | as T2) +union withsource=TableName (range x from 1 to 5 step 1 | as T1), (range x from 1 to 5 step 1 | as T2) ``` -In the following example, the 'left side' of the join will be: +**Output** + +| TableName| x | +|--|---| +| T1 | 1 | +| T1 | 2 | +| T1 | 3 | +| T1 | 4 | +| T1 | 5 | +| T2 | 1 | +| T2 | 2 | +| T2 | 3 | +| T2 | 4 | +| T2 | 5 | + +In the following example, the 'left side' of the join is: `MyLogTable` filtered by `type == "Event"` and `Name == "Start"` -and the 'right side' of the join will be: +and the 'right side' of the join is: `MyLogTable` filtered by `type == "Event"` and `Name == "Stop"` ```kusto diff --git a/data-explorer/kusto/query/batches.md b/data-explorer/kusto/query/batches.md index eec2c34b76..0ef9c67de0 100644 --- a/data-explorer/kusto/query/batches.md +++ b/data-explorer/kusto/query/batches.md @@ -3,7 +3,7 @@ title: Batches description: This article describes Batches. ms.reviewer: alexans ms.topic: reference -ms.date: 01/13/2025 +ms.date: 01/27/2025 --- # Batches @@ -18,7 +18,9 @@ A query can include multiple tabular expression statements, as long as they're d ## Examples -[!INCLUDE [help-cluster](../includes/help-cluster-samples-stormevents.md)] +[!INCLUDE [help-cluster](../includes/help-cluster-note.md)] + +The following examples show how to create multiple tables simultaneously. ### Name tabular results diff --git a/data-explorer/kusto/query/count-operator.md b/data-explorer/kusto/query/count-operator.md index 7b8ed0c4fe..1fb33f76f6 100644 --- a/data-explorer/kusto/query/count-operator.md +++ b/data-explorer/kusto/query/count-operator.md @@ -3,14 +3,12 @@ title: count operator description: Learn how to use the count operator to return the number of records in the input record set. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 -monikerRange: "microsoft-fabric || azure-data-explorer || azure-monitor || microsoft-sentinel " +ms.date: 01/15/2025 --- # count operator > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] - Returns the number of records in the input record set. ## Syntax @@ -32,6 +30,10 @@ This function returns a table with a single record and column of type ## Example +[!INCLUDE [help-cluster](../includes/help-cluster-note.md)] + +When you use the count operator with a table name, like StormEvents, it will return the total number of records in that table. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -41,6 +43,12 @@ This function returns a table with a single record and column of type StormEvents | count ``` +**Output** + +| Count | +|-------| +| 59066 | + ## Related content For information about the count() aggregation function, see [count() (aggregation function)](count-aggregation-function.md). diff --git a/data-explorer/kusto/query/datatable-operator.md b/data-explorer/kusto/query/datatable-operator.md index 27b3696c9d..fb3c32721d 100644 --- a/data-explorer/kusto/query/datatable-operator.md +++ b/data-explorer/kusto/query/datatable-operator.md @@ -3,7 +3,7 @@ title: datatable operator description: Learn how to use the datatable operator to define a table with given schema and data. ms.reviewer: alexans ms.topic: reference -ms.date: 01/07/2025 +ms.date: 01/21/2025 --- # datatable operator @@ -37,6 +37,8 @@ This operator returns a data table of the given schema and data. ## Example +This example creates a table with *Date*, *Event*, and *MoreData* columns, filters rows with Event descriptions longer than 4 characters, and adds a new column *key2* to each row from the MoreData dynamic object. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -55,7 +57,7 @@ datatable(Date:datetime, Event:string, MoreData:dynamic) [ **Output** -|Date|Event|MoreData|key2| -|---|---|---|---| -|1930-01-01 00:00:00.0000000|Enters Ecole Navale|{
"key1": "value3",
"key2": "value4"
}|value4| -|1953-01-01 00:00:00.0000000|Published first book|{
"key1": "value5",
"key2": "value6"
}|value6| +| Date | Event | MoreData | key2 | +|--|--|--|--| +| 1930-01-01 00:00:00.0000000 | Enters Ecole Navale | {
"key1": "value3",
"key2": "value4"
} | value4 | +| 1953-01-01 00:00:00.0000000 | Published first book | {
"key1": "value5",
"key2": "value6"
} | value6 | diff --git a/data-explorer/kusto/query/externaldata-operator.md b/data-explorer/kusto/query/externaldata-operator.md index a33dd6241b..6e343565c8 100644 --- a/data-explorer/kusto/query/externaldata-operator.md +++ b/data-explorer/kusto/query/externaldata-operator.md @@ -3,8 +3,7 @@ title: externaldata operator description: Learn how to use the externaldata operator to return a data table of the given schema whose data was parsed from the specified storage artifact. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 -monikerRange: "microsoft-fabric || azure-data-explorer || azure-monitor || microsoft-sentinel" +ms.date: 01/27/2025 --- # externaldata operator @@ -13,14 +12,10 @@ monikerRange: "microsoft-fabric || azure-data-explorer || azure-monitor || micro The `externaldata` operator returns a table whose schema is defined in the query itself, and whose data is read from an external storage artifact, such as a blob in Azure Blob Storage or a file in Azure Data Lake Storage. > [!NOTE] -> The `externaldata` operator supports a specific set of storage services, as listed under [Storage connection strings](../api/connection-strings/storage-connection-strings.md). - -> [!NOTE] -> The `externaldata` operator supports Shared Access Signature (SAS) key, Access key, and Microsoft Entra Token authentication methods. For more information, see [Storage authentication methods](../api/connection-strings/storage-connection-strings.md). - -::: moniker range="microsoft-fabric || azure-data-explorer" - -::: moniker-end +> The `externaldata` operator supports: +> +> * a specific set of storage services, as listed under [Storage connection strings](../api/connection-strings/storage-connection-strings.md). +> * shared Access Signature (SAS) key, Access key, and Microsoft Entra Token authentication methods. For more information, see [Storage authentication methods](../api/connection-strings/storage-connection-strings.md#storage-authentication-methods). ::: moniker range="azure-monitor || microsoft-sentinel" @@ -48,9 +43,9 @@ The `externaldata` operator returns a table whose schema is defined in the query ### Supported properties -| Property | Type | Description | -|------------------|----------|-------------------| -| format | `string` | The data format. If unspecified, an attempt is made to detect the data format from file extension. The default is `CSV`. All [ingestion data formats](../ingestion-supported-formats.md) are supported. | +| Property | Type | Description | +|--|--|--| +| format | `string` | The data format. If unspecified, an attempt is made to detect the data format from file extension. The default is `CSV`. All [ingestion data formats](../ingestion-supported-formats.md) are supported. | | ignoreFirstRecord | `bool` | If set to `true`, the first record in every file is ignored. This property is useful when querying CSV files with headers. | | ingestionMapping | `string` | Indicates how to map data from the source file to the actual columns in the operator result set. See [data mappings](../management/mappings.md). | @@ -66,6 +61,8 @@ The `externaldata` operator returns a data table of the given schema whose data ## Examples +The examples query data in an external storage file. + ### Fetch a list of user IDs stored in Azure Blob Storage The following example shows how to find all records in a table whose `UserID` column falls into a known set of IDs, held (one per line) in an external storage file. Since the data format isn't specified, the detected data format is `TXT`. @@ -134,4 +131,6 @@ with(format='multijson', ingestionMapping='[{"Column":"Timestamp","Properties":{ The `MultiJSON` format is used here because single JSON records are spanned into multiple lines. +## Related content + For more info on mapping syntax, see [data mappings](../management/mappings.md). diff --git a/data-explorer/kusto/query/find-operator.md b/data-explorer/kusto/query/find-operator.md index 33094c8e8e..e560605190 100644 --- a/data-explorer/kusto/query/find-operator.md +++ b/data-explorer/kusto/query/find-operator.md @@ -3,7 +3,7 @@ title: find operator description: Learn how to use the find operator to find rows that match a predicate across a set of tables. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 01/20/2025 monikerRange: "microsoft-fabric || azure-data-explorer || azure-monitor || microsoft-sentinel" --- # find operator @@ -14,7 +14,7 @@ Finds rows that match a predicate across a set of tables. ::: moniker range="microsoft-fabric || azure-data-explorer" -The scope of the `find` can also be cross-database or cross-cluster. +The scope of the `find` operator can also be cross-database or cross-cluster. ```kusto find in (Table1, Table2, Table3) where Fruit=="apple" @@ -33,7 +33,7 @@ find in (Table1, Table2, Table3) where Fruit=="apple" ``` > [!NOTE] -> `find` operator is substantially less efficient than column-specific text filtering. Whenever the columns are known, we recommend using the [where operator](where-operator.md). `find` will not function well when the workspace contains large number of tables and columns and the data volume that is being scanned is high and the time range of the query is high. +> `find` operator is substantially less efficient than column-specific text filtering. Whenever the columns are known, we recommend using the [where operator](where-operator.md). `find` doesn't function well when the workspace contains large number of tables and columns and the data volume that is being scanned is high and the time range of the query is high. ::: moniker-end @@ -51,23 +51,23 @@ find in (Table1, Table2, Table3) where Fruit=="apple" |Name|Type|Required|Description| |--|--|--|--| -|*ColumnName*| `string` | | By default, the output will include a column called *source_* whose values indicate which source table has contributed each row. If specified, *ColumnName* will be used instead of *source_*. After wildcard matching, if the query references tables from more than one database including the default database, the value of this column will have a table name qualified with the database. Similarly *cluster* and *database* qualifications will be present in the value if more than one cluster is referenced.| +|*ColumnName*| `string` | | By default, the output includes a column called *source_* whose values indicate which source table contributed to each row. If specified, *ColumnName* is used instead of *source_*. After wildcard matching, if the query references tables from more than one database including the default database, the value of this column has a table name qualified with the database. Similarly *cluster* and *database* qualifications are present in the value if more than one cluster is referenced.| | *Predicate* | `bool` | :heavy_check_mark: | This boolean expression is evaluated for each row in each input table. For more information, see [predicate-syntax details](find-operator.md#predicate-syntax).| -| *Tables* | `string` | | Zero or more comma-separated table references. By default, `find` will look in all the tables in the current database. You can use:
1. The name of a table, such as `Events`
2. A query expression, such as `(Events | where id==42)`
3. A set of tables specified with a wildcard. For example, `E*` would form the union of all the tables in the database whose names begin with `E`.| -| `project-smart` or `project` | `string` | | If not specified, `project-smart` will be used by default. For more information, see [output-schema details](find-operator.md#output-schema).| +| *Tables* | `string` | | Zero or more comma-separated table references. By default, `find` looks in all the tables in the current database. You can use:
1. The name of a table, such as `Events`
2. A query expression, such as `(Events | where id==42)`
3. A set of tables specified with a wildcard. For example, `E*` would form the union of all the tables in the database whose names begin with `E`.| +| `project-smart` or `project` | `string` | | If not specified, `project-smart` is used by default. For more information, see [output-schema details](find-operator.md#output-schema).| ::: moniker-end ::: moniker range="azure-monitor || microsoft-sentinel" -* `withsource=`*ColumnName*: Optional. By default, the output will include a column called *source_* whose values indicate which source table contributed each row. If specified, *ColumnName* will be used instead of *source_*. +* `withsource=`*ColumnName*: Optional. By default, the output includes a column called *source_* whose values indicate which source table contributed each row. If specified, *ColumnName* is used instead of *source_*. * *Predicate*: A `boolean` [expression](scalar-data-types/bool.md) over the columns of the input tables *Table* [`,` *Table*, ...]. It's evaluated for each row in each input table. For more information, see [predicate-syntax details](find-operator.md#predicate-syntax). -* *Tables*: Optional. Zero or more comma-separated table references. By default *find* will search all tables for: +* *Tables*: Optional. Zero or more comma-separated table references. By default *find* searches all tables for: * The name of a table, such as `Events` * A query expression, such as `(Events | where id==42)` * A set of tables specified with a wildcard. For example, `E*` would form the union of all the tables whose names begin with `E`. -* `project-smart` | `project`: If not specified `project-smart` will be used by default. For more information, see [output-schema details](find-operator.md#output-schema). +* `project-smart` | `project`: If not specified `project-smart` is used by default. For more information, see [output-schema details](find-operator.md#output-schema). ::: moniker-end @@ -79,38 +79,38 @@ Transformation of rows in *Table* [`,` *Table*, ...] for which *Predicate* is `t **source_ column** -The find operator output will always include a *source_* column with the source table name. The column can be renamed using the `withsource` parameter. +The `find` operator output always includes a *source_* column with the source table name. The column can be renamed using the `withsource` parameter. **results columns** -Source tables that don't contain any column used by the predicate evaluation, will be filtered out. +Source tables that don't contain any column used by the predicate evaluation, are filtered out. -When you use `project-smart`, the columns that will appear in the output will be: +When you use `project-smart`, the columns that appear in the output are: * Columns that appear explicitly in the predicate. * Columns that are common to all the filtered tables. -The rest of the columns will be packed into a property bag and will appear in an additional `pack` column. -A column that is referenced explicitly by the predicate and appears in multiple tables with multiple types, will have a different column in the result schema for each such type. Each of the column names will be constructed from the original column name and type, separated by an underscore. +The rest of the columns are packed into a property bag and appear in an extra `pack` column. +A column that is referenced explicitly by the predicate and appears in multiple tables with multiple types, has a different column in the result schema for each such type. Each of the column names is constructed from the original column name and type, separated by an underscore. When using `project` *ColumnName*[`:` *ColumnType* `,` ... ] [`,` `pack_all()`]: -* The result table will include the columns specified in the list. If a source table doesn't contain a certain column, the values in the corresponding rows will be null. -* When specifying a *ColumnType* with a *ColumnName*, this column in the "result" will have the given type, and the values will be cast to that type if needed. The casting won't have an effect on the column type when evaluating the *Predicate*. -* When `pack_all()` is used, all the columns, including the projected columns, are packed into a property bag and appear in an additional column, by default 'column1'. In the property bag, the source column name serves as the property name and the column's value serves as the property value. +* The result table includes the columns specified in the list. If a source table doesn't contain a certain column, the values in the corresponding rows are null. +* When you specify a *ColumnType* with a *ColumnName*, this column in the "result" has the given type, and the values are cast to that type if needed. The casting doesn't have an effect on the column type when evaluating the *Predicate*. +* When `pack_all()` is used, all the columns, including the projected columns, are packed into a property bag and appear in an extra column, by default 'column1'. In the property bag, the source column name serves as the property name and the column's value serves as the property value. ## Predicate syntax -The *find* operator supports an alternative syntax for the `* has` term, and using just *term*, will search a term across all input columns. +The `find` operator supports an alternative syntax for the `* has` term, and using just *term*, searches a term across all input columns. For a summary of some filtering functions, see [where operator](where-operator.md). -## Notes +## Considerations * If the `project` clause references a column that appears in multiple tables and has multiple types, a type must follow this column reference in the project clause -* If a column appears in multiple tables and has multiple types and `project-smart` is in use, there will be a corresponding column for each type in the `find`'s result, as described in [union](union-operator.md) -* When you use *project-smart*, changes in the predicate, in the source tables set, or in the tables schema, may result in a change to the output schema. If a constant result schema is needed, use *project* instead -* `find` scope can't include [functions](../management/functions.md). To include a function in the find scope, define a [let statement](let-statement.md) with [view keyword](let-statement.md). +* If a column appears in multiple tables and has multiple types and `project-smart` is in use, there's a corresponding column for each type in the `find`'s result, as described in [union](union-operator.md) +* When you use *project-smart*, changes in the predicate, in the source tables set, or in the tables schema, might result in a change to the output schema. If a constant result schema is needed, use *project* instead +* `find` scope can't include [functions](../management/functions.md). To include a function in the `find` scope, define a [let statement](let-statement.md) with [view keyword](let-statement.md). ## Performance tips @@ -119,14 +119,16 @@ If tabular expression, the find operator falls back to a `union` query that can * If a column that appears in multiple tables and has multiple types, is part of the project clause, prefer adding a *ColumnType* to the project clause over modifying the table before passing it to `find`. * Add time-based filters to the predicate. Use a datetime column value or [ingestion_time()](ingestion-time-function.md). * Search in specific columns rather than a full text search. -* It's better not to reference columns that appear in multiple tables and have multiple types. If the predicate is valid when resolving such columns type for more than one type, the query will fall back to union. -For example, see [examples of cases where find will act as a union](find-operator.md#examples-of-cases-where-find-will-act-as-union). +* It's better not to reference columns that appear in multiple tables and have multiple types. If the predicate is valid when resolving such columns type for more than one type, the query falls back to union. +For example, see [examples of cases where `find` acts as a union](find-operator.md#examples-of-cases-where-find-acts-as-union). ## Examples +[!INCLUDE [help-cluster](../includes/help-cluster-note.md)] + ::: moniker range="microsoft-fabric || azure-data-explorer" -### Term lookup across all tables in current database +### Term lookup across all tables The query finds all rows from all tables in the current database in which any column includes the word `Hernandez`. The resulting records are transformed according to the [output schema](#output-schema). The output includes rows from the `Customers` table and the `SalesTable` table of the `ContosoSales` database. @@ -137,10 +139,20 @@ The query finds all rows from all tables in the current database in which any co find "Hernandez" ``` -### Term lookup across all tables matching a name pattern in the current database +**Output** -The query finds all rows from all tables in the current database whose name starts with `C`, and in which any column includes the word `Hernandez`. The resulting records are transformed according to the [output schema](#output-schema). Now, the output only contains records from the `Customers` table. +This table shows the first three rows of the output. +| source_ | pack_ | +|--|--| +| Customers |{"CityName":"Ballard","CompanyName":"NULL","ContinentName":"North America","CustomerKey":5023,"Education":"Partial High School","FirstName":"Devin","Gender":"M","LastName":"Hernandez","MaritalStatus":"S","Occupation":"Clerical","RegionCountryName":"United States","StateProvinceName":"Washington"} | +| Customers |{"CityName":"Ballard","CompanyName":"NULL","ContinentName":"North America","CustomerKey":7814,"Education":"Partial College","FirstName":"Kristy","Gender":"F","LastName":"Hernandez","MaritalStatus":"S","Occupation":"Professional","RegionCountryName":"United States","StateProvinceName":"Washington"} | +| Customers |{"CityName":"Ballard","CompanyName":"NULL","ContinentName":"North America","CustomerKey":7888,"Education":"Partial High School","FirstName":"Kari","Gender":"F","LastName":"Hernandez","MaritalStatus":"S","Occupation":"Clerical","RegionCountryName":"United States","StateProvinceName":"Washington"} | +|...|...| + +### Term lookup across all tables matching a name pattern + +The query finds all rows from all tables in the current database whose name starts with `C`, and in which any column includes the word `Hernandez`. The resulting records are transformed according to the [output schema](#output-schema). Now, the output only contains records from the `Customers` table. > [!div class="nextstepaction"] > Run the query @@ -149,9 +161,20 @@ The query finds all rows from all tables in the current database whose name star find in (C*) where * has "Hernandez" ``` -### Term lookup across all tables in all databases in the cluster +**Output** + +This table shows the first three rows of the output. + +| source_ | pack_ | +|--|--| +| ConferenceSessions | {"conference":"Build 2021","sessionid":"CON-PRT103","session_title":"Roundtable: Advanced Kusto query language topics","session_type":"Roundtable","owner":"Avner Aharoni","participants":"Alexander Sloutsky, Tzvia Gitlin-Troyna","URL":"https://sessions.mybuild.microsoft.com/sessions/details/4d4887e9-f08d-4f88-99ac-41e5feb869e7","level":200,"session_location":"Online","starttime":"2021-05-26T08:30:00.0000000Z","duration":60,"time_and_duration":"Wednesday, May 26\n8:30 AM - 9:30 AM GMT","kusto_affinity":"Focused"} | +| ConferenceSessions | {"conference":"Ignite 2018","sessionid":"THR3115","session_title":"Azure Log Analytics: Deep dive into the Azure Kusto query language. ","session_type":"Theater","owner":"Jean Francois Berenguer","participants":"","URL":"https://myignite.techcommunity.microsoft.com/sessions/66329","level":300,"session_location":"","starttime":null,"duration":null,"time_and_duration":"","kusto_affinity":"Focused"} | +| ConferenceSessions | {"conference":"Build 2021","sessionid":"CON-PRT103","session_title":"Roundtable: Advanced Kusto query language topics","session_type":"Roundtable","owner":"Avner Aharoni","participants":"Alexander Sloutsky, Tzvia Gitlin-Troyna","URL":"https://sessions.mybuild.microsoft.com/sessions/details/4d4887e9-f08d-4f88-99ac-41e5feb869e7","level":200,"session_location":"Online","starttime":"2021-05-26T08:30:00.0000000Z","duration":60,"time_and_duration":"Wednesday, May 26\n8:30 AM - 9:30 AM GMT","kusto_affinity":"Focused"} | +|...|...| -The query finds all rows from all tables in all databases in which any column includes the word `Kusto`. +### Term lookup across the cluster + +The query finds all rows from all tables in all databases in the cluster in which any column includes the word `Kusto`. This query is a [cross-database](cross-cluster-or-database-queries.md) query. The resulting records are transformed according to the [output schema](#output-schema). @@ -162,19 +185,41 @@ The resulting records are transformed according to the [output schema](#output-s find in (database('*').*) where * has "Kusto" ``` -### Term lookup across all tables and databases matching a name pattern in the cluster +**Output** + +This table shows the first three rows of the output. + +| source_ | pack_ | +|--|--| +| database("Samples").ConferenceSessions | {"conference":"Build 2021","sessionid":"CON-PRT103","session_title":"Roundtable: Advanced Kusto query language topics","session_type":"Roundtable","owner":"Avner Aharoni","participants":"Alexander Sloutsky, Tzvia Gitlin-Troyna","URL":"https://sessions.mybuild.microsoft.com/sessions/details/4d4887e9-f08d-4f88-99ac-41e5feb869e7","level":200,"session_location":"Online","starttime":"2021-05-26T08:30:00.0000000Z","duration":60,"time_and_duration":"Wednesday, May 26\n8:30 AM - 9:30 AM GMT","kusto_affinity":"Focused"} | +| database("Samples").ConferenceSessions | {"conference":"Ignite 2018","sessionid":"THR3115","session_title":"Azure Log Analytics: Deep dive into the Azure Kusto query language. ","session_type":"Theater","owner":"Jean Francois Berenguer","participants":"","URL":"https://myignite.techcommunity.microsoft.com/sessions/66329","level":300,"session_location":"","starttime":null,"duration":null,"time_and_duration":"","kusto_affinity":"Focused"} | +| database("Samples").ConferenceSessions | {"conference":"Build 2021","sessionid":"CON-PRT103","session_title":"Roundtable: Advanced Kusto query language topics","session_type":"Roundtable","owner":"Avner Aharoni","participants":"Alexander Sloutsky, Tzvia Gitlin-Troyna","URL":"https://sessions.mybuild.microsoft.com/sessions/details/4d4887e9-f08d-4f88-99ac-41e5feb869e7","level":200,"session_location":"Online","starttime":"2021-05-26T08:30:00.0000000Z","duration":60,"time_and_duration":"Wednesday, May 26\n8:30 AM - 9:30 AM GMT","kusto_affinity":"Focused"} +|...|...| + +### Term lookup matching a name pattern in the cluster The query finds all rows from all tables whose name starts with `K` in all databases whose name start with `B` and in which any column includes the word `Kusto`. The resulting records are transformed according to the [output schema](#output-schema). > [!div class="nextstepaction"] -> Run the query +> Run the query ```kusto find in (database("S*").C*) where * has "Kusto" ``` +**Output** + +This table shows the first three rows of the output. + +| source_ | pack_ | +|--|--| +| ConferenceSessions | {"conference":"Build 2021","sessionid":"CON-PRT103","session_title":"Roundtable: Advanced Kusto query language topics","session_type":"Roundtable","owner":"Avner Aharoni","participants":"Alexander Sloutsky, Tzvia Gitlin-Troyna","URL":"https://sessions.mybuild.microsoft.com/sessions/details/4d4887e9-f08d-4f88-99ac-41e5feb869e7","level":200,"session_location":"Online","starttime":"2021-05-26T08:30:00.0000000Z","duration":60,"time_and_duration":"Wednesday, May 26\n8:30 AM - 9:30 AM GMT","kusto_affinity":"Focused"} | +| ConferenceSessions | {"conference":"Build 2021","sessionid":"CON-PRT103","session_title":"Roundtable: Advanced Kusto query language topics","session_type":"Roundtable","owner":"Avner Aharoni","participants":"Alexander Sloutsky, Tzvia Gitlin-Troyna","URL":"https://sessions.mybuild.microsoft.com/sessions/details/4d4887e9-f08d-4f88-99ac-41e5feb869e7","level":200,"session_location":"Online","starttime":"2021-05-26T08:30:00.0000000Z","duration":60,"time_and_duration":"Wednesday, May 26\n8:30 AM - 9:30 AM GMT","kusto_affinity":"Focused"} | +| ConferenceSessions | {"conference":"Build 2021","sessionid":"CON-PRT103","session_title":"Roundtable: Advanced Kusto query language topics","session_type":"Roundtable","owner":"Avner Aharoni","participants":"Alexander Sloutsky, Tzvia Gitlin-Troyna","URL":"https://sessions.mybuild.microsoft.com/sessions/details/4d4887e9-f08d-4f88-99ac-41e5feb869e7","level":200,"session_location":"Online","starttime":"2021-05-26T08:30:00.0000000Z","duration":60,"time_and_duration":"Wednesday, May 26\n8:30 AM - 9:30 AM GMT","kusto_affinity":"Focused"} | +|...|...| + ### Term lookup in several clusters The query finds all rows from all tables whose name starts with `K` in all databases whose name start with `B` and in which any column includes the word `Kusto`. @@ -223,7 +268,9 @@ Assume we have the next content of these two tables: |acbd207d-51aa-4df7-bfa7-be70eb68f04e|Error|Some Other Text3|Event3 |15eaeab5-8576-4b58-8fc6-478f75d8fee4|Error|Some Other Text4|Event4 -### Search in common columns, project common and uncommon columns, and pack the rest +### Search in common columns, project common, and uncommon columns, and pack the rest + +The query searches for specific records in *EventsTable1* and *EventsTable2* based on a given *Session_Id* and an *Error* Level. It then projects three specific columns: *EventText*, *Version*, and *EventName*, and packs all other remaining columns into a dynamic object. ```kusto find in (EventsTable1, EventsTable2) @@ -240,6 +287,8 @@ find in (EventsTable1, EventsTable2) ### Search in common and uncommon columns +The query searches for records that either have *Version* as 'v1.0.0' or *EventName* as 'Event1', and then it projects (selects) four specific columns: *Session_Id*, *EventText*, *Version*, and *EventName* from those filtered results. + ```kusto find Version == 'v1.0.0' or EventName == 'Event1' project Session_Id, EventText, Version, EventName ``` @@ -248,14 +297,17 @@ find Version == 'v1.0.0' or EventName == 'Event1' project Session_Id, EventText, |source_|Session_Id|EventText|Version|EventName| |---|---|---|---|---| -|EventsTable1|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Some Text1|v1.0.0 -|EventsTable1|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Some Text2|v1.0.0 -|EventsTable2|f7d5f95f-f580-4ea6-830b-5776c8d64fdd|Some Other Text1||Event1 +|EventsTable1|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Some Text1|v1.0.0| +|EventsTable1|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Some Text2|v1.0.0| +|EventsTable2|f7d5f95f-f580-4ea6-830b-5776c8d64fdd|Some Other Text1||Event1| -Note: in practice, *EventsTable1* rows will be filtered with ```Version == 'v1.0.0'``` predicate and *EventsTable2* rows will be filtered with ```EventName == 'Event1'``` predicate. +> [!NOTE] +> In practice, *EventsTable1* rows are filtered with ```Version == 'v1.0.0'``` predicate and *EventsTable2* rows are filtered with ```EventName == 'Event1'``` predicate. ### Use abbreviated notation to search across all tables in the current database +This query searches the database for any records with a *Session_Id* that matches 'acbd207d-51aa-4df7-bfa7-be70eb68f04e'. It retrieves records from all tables and columns that contain this specific *Session_Id*. + ```kusto find Session_Id == 'acbd207d-51aa-4df7-bfa7-be70eb68f04e' ``` @@ -264,13 +316,15 @@ find Session_Id == 'acbd207d-51aa-4df7-bfa7-be70eb68f04e' |source_|Session_Id|Level|EventText|pack_| |---|---|---|---|---| -|EventsTable1|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Information|Some Text1|{"Version":"v1.0.0"} -|EventsTable1|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Error|Some Text2|{"Version":"v1.0.0"} -|EventsTable2|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Information|Some Other Text2|{"EventName":"Event2"} -|EventsTable2|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Error|Some Other Text3|{"EventName":"Event3"} +|EventsTable1|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Information|Some Text1|{"Version":"v1.0.0"}| +|EventsTable1|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Error|Some Text2|{"Version":"v1.0.0"}| +|EventsTable2|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Information|Some Other Text2|{"EventName":"Event2"}| +|EventsTable2|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Error|Some Other Text3|{"EventName":"Event3"}| ### Return the results from each row as a property bag +This query searches the database for records with the specified *Session_Id* and returns all columns of those records as a single dynamic object. + ```kusto find Session_Id == 'acbd207d-51aa-4df7-bfa7-be70eb68f04e' project pack_all() ``` @@ -279,14 +333,18 @@ find Session_Id == 'acbd207d-51aa-4df7-bfa7-be70eb68f04e' project pack_all() |source_|pack_| |---|---| -|EventsTable1|{"Session_Id":"acbd207d-51aa-4df7-bfa7-be70eb68f04e", "Level":"Information", "EventText":"Some Text1", "Version":"v1.0.0"} -|EventsTable1|{"Session_Id":"acbd207d-51aa-4df7-bfa7-be70eb68f04e", "Level":"Error", "EventText":"Some Text2", "Version":"v1.0.0"} -|EventsTable2|{"Session_Id":"acbd207d-51aa-4df7-bfa7-be70eb68f04e", "Level":"Information", "EventText":"Some Other Text2", "EventName":"Event2"} -|EventsTable2|{"Session_Id":"acbd207d-51aa-4df7-bfa7-be70eb68f04e", "Level":"Error", "EventText":"Some Other Text3", "EventName":"Event3"} +|EventsTable1|{"Session_Id":"acbd207d-51aa-4df7-bfa7-be70eb68f04e", "Level":"Information", "EventText":"Some Text1", "Version":"v1.0.0"}| +|EventsTable1|{"Session_Id":"acbd207d-51aa-4df7-bfa7-be70eb68f04e", "Level":"Error", "EventText":"Some Text2", "Version":"v1.0.0"}| +|EventsTable2|{"Session_Id":"acbd207d-51aa-4df7-bfa7-be70eb68f04e", "Level":"Information", "EventText":"Some Other Text2", "EventName":"Event2"}| +|EventsTable2|{"Session_Id":"acbd207d-51aa-4df7-bfa7-be70eb68f04e", "Level":"Error", "EventText":"Some Other Text3", "EventName":"Event3"}| + +## Examples of cases where `find` acts as `union` + +The `find` operator in Kusto can sometimes act like a `union` operator, mainly when it's used to search across multiple tables. -## Examples of cases where `find` will act as `union` +### Using a nontabular expression as find operand -### Using a non-tabular expression as find operand +The query first creates a view that filters *EventsTable1* to only include error-level records. Then, it searches within this filtered view and the EventsTable2 table for records with a specific *Session_Id*. ```kusto let PartialEventsTable1 = view() { EventsTable1 | where Level == 'Error' }; @@ -296,7 +354,7 @@ find in (PartialEventsTable1, EventsTable2) ### Referencing a column that appears in multiple tables and has multiple types -Assume we've created two tables by running: +For this example, create two tables by running: ```kusto .create tables @@ -304,18 +362,18 @@ Assume we've created two tables by running: Table2 (Level:string, Timestamp:datetime, ProcessId:int64) ``` -* The following query will be executed as `union`. +* The following query is executed as `union`. ```kusto find in (Table1, Table2) where ProcessId == 1001 ``` -The output result schema will be *(Level:string, Timestamp, ProcessId_string, ProcessId_int)*. +The output result schema is *(Level:string, Timestamp, ProcessId_string, ProcessId_int)*. -* The following query will also be executed as `union`, but will produce a different result schema. +* The following query is executed as `union`, but produces a different result schema. ```kusto find in (Table1, Table2) where ProcessId == 1001 project Level, Timestamp, ProcessId:string ``` -The output result schema will be *(Level:string, Timestamp, ProcessId_string)* +The output result schema is *(Level:string, Timestamp, ProcessId_string)* diff --git a/data-explorer/kusto/query/fork-operator.md b/data-explorer/kusto/query/fork-operator.md index baf0794343..1a21bc307f 100644 --- a/data-explorer/kusto/query/fork-operator.md +++ b/data-explorer/kusto/query/fork-operator.md @@ -3,7 +3,7 @@ title: fork operator description: Learn how to use the fork operator to run multiple consumer operators in parallel. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 01/21/2025 monikerRange: "microsoft-fabric || azure-data-explorer" --- # fork operator @@ -28,7 +28,7 @@ Runs multiple consumer operators in parallel. > [!NOTE] > > * Avoid using `fork` with a single *subquery*. -> * The name of the results tab will be the same name as provided with the `name` parameter or the [`as` operator](as-operator.md). +> * The name of the results tab is the same name as provided with the `name` parameter or the [`as` operator](as-operator.md). ### Supported query operators @@ -56,12 +56,16 @@ Multiple result tables, one for each of the *subquery* arguments. ## Tips -* Use [`materialize`](materialize-function.md) as a replacement for [`join`](join-operator.md) or [`union`](union-operator.md) on fork legs. The input stream will be cached by materialize and then the cached expression can be used in join/union legs. +* Use [`materialize`](materialize-function.md) as a replacement for [`join`](join-operator.md) or [`union`](union-operator.md) on fork legs. The input stream is cached by materialize and then the cached expression can be used in join/union legs. * Use [batch](batches.md) with [`materialize`](materialize-function.md) of tabular expression statements instead of the `fork` operator. ## Examples +[!INCLUDE [help-cluster-note](../includes/help-cluster-note.md)] + +The examples output multiple tables, with named and umnamed columns. + ### Unnamed subqueries :::moniker range="azure-data-explorer" @@ -77,9 +81,33 @@ StormEvents ( where InjuriesDirect + InjuriesIndirect > 1) ``` +**Output** + +This output shows the first few rows and columns of the result table. + +### [GenericResult](#tab/generic-result-1) + +| StartTime | EndTime | EpisodeId | EventId | State | EventType | InjuriesDirect | InjuriesIndirect | +|--|--|--|--|--|--|--|--| +| 2007-02-02T03:17:00Z | 2007-02-02T03:25:00Z | 3464 | 18948 | FLORIDA | Tornado | 10 | 0 | +| 2007-02-02T03:37:00Z | 2007-02-02T03:55:00Z | 3464 | 18950 | FLORIDA | Tornado | 9 | 0 | +| 2007-03-13T08:20:00Z | 2007-03-13T08:20:00Z | 4094 | 22961 | FLORIDA | Dense Fog | 3 | 0 | +| 2007-09-11T15:26:00Z | 2007-09-11T15:26:00Z | 9578 | 53798 | FLORIDA | Rip Current | 0 | 0 | + +### [GenericResult](#tab/generic-result-2) + +| StartTime | EndTime | EpisodeId | EventId | State | EventType | InjuriesDirect | InjuriesIndirect | +|--|--|--|--|--|--|--|--| +| 2007-02-02T03:10:00Z | 2007-02-02T03:16:00Z | 2545 | 17515 | FLORIDA | Tornado | 15 | 0 | +| 2007-02-02T03:17:00Z | 2007-02-02T03:25:00Z | 3464 | 18948 | FLORIDA | Tornado | 10 | 0 | +| 2007-02-02T03:37:00Z | 2007-02-02T03:55:00Z | 3464 | 18950 | FLORIDA | Tornado | 9 | 0 | +| 2007-02-02T03:55:00Z | 2007-02-02T04:10:00Z | 3464 | 20318 | FLORIDA | Tornado | 42 | 0 | + +--- + ### Named subqueries -In the following examples, the result tables will be named "StormsWithDeaths" and "StormsWithInjuries". +In the following examples, the result table is named "StormsWithDeaths" and "StormsWithInjuries". :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -106,3 +134,27 @@ StormEvents StormsWithDeaths = (where DeathsDirect + DeathsIndirect > 1) StormsWithInjuries = (where InjuriesDirect + InjuriesIndirect > 1) ``` + +**Output** + +This output shows the first few rows and columns of the result table. + +#### [StormsWithDeaths](#tab/deaths) + +| StartTime | EndTime | EpisodeId | EventId | State | EventType | InjuriesDirect | InjuriesIndirect | +|--|--|--|--|--|--|--|--| +| 2007-02-02T03:17:00Z | 2007-02-02T03:25:00Z | 3464 | 18948 | FLORIDA | Tornado | 10 | 0 | +| 2007-02-02T03:37:00Z | 2007-02-02T03:55:00Z | 3464 | 18950 | FLORIDA | Tornado | 9 | 0 | +| 2007-03-13T08:20:00Z | 2007-03-13T08:20:00Z | 4094 | 22961 | FLORIDA | Dense Fog | 3 | 0 | +| 2007-09-11T15:26:00Z | 2007-09-11T15:26:00Z | 9578 | 53798 | FLORIDA | Rip Current | 0 | 0 | + +#### [StormsWithInjuries](#tab/injuries) + +| StartTime | EndTime | EpisodeId | EventId | State | EventType | InjuriesDirect | InjuriesIndirect | +|--|--|--|--|--|--|--|--| +| 2007-02-02T03:10:00Z | 2007-02-02T03:16:00Z | 2545 | 17515 | FLORIDA | Tornado | 15 | 0 | +| 2007-02-02T03:17:00Z | 2007-02-02T03:25:00Z | 3464 | 18948 | FLORIDA | Tornado | 10 | 0 | +| 2007-02-02T03:37:00Z | 2007-02-02T03:55:00Z | 3464 | 18950 | FLORIDA | Tornado | 9 | 0 | +| 2007-02-02T03:55:00Z | 2007-02-02T04:10:00Z | 3464 | 20318 | FLORIDA | Tornado | 42 | 0 | + +---