Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
6026a7b
replace branch PR 6555 (3)
ktalmor Jan 26, 2025
e6eeec9
Merge branch 'main' of https://github.com/ktalmor/dataexplorer-docs-p…
ktalmor Jan 28, 2025
676758d
Added example descriptions
ktalmor Jan 28, 2025
3fcb4c6
small fixes
ktalmor Jan 29, 2025
30666fb
Merge branch 'main' of https://github.com/MicrosoftDocs/dataexplorer-…
ktalmor Jan 29, 2025
bdcb985
Merge branch 'main' of https://github.com/MicrosoftDocs/dataexplorer-…
ktalmor Jan 29, 2025
dab2a4c
removed sentence
ktalmor Jan 29, 2025
53f908c
Merge branch 'main' of https://github.com/MicrosoftDocs/dataexplorer-…
ktalmor Feb 2, 2025
433fa2e
Merge branch 'main' of https://github.com/MicrosoftDocs/dataexplorer-…
ktalmor Feb 4, 2025
e148f17
Added Examples introductory sentence
ktalmor Feb 5, 2025
1535083
Merge branch 'main' of https://github.com/MicrosoftDocs/dataexplorer-…
ktalmor Feb 6, 2025
1514ee3
Added Jan 2025
ktalmor Feb 6, 2025
1c6b6cc
Fixed links
ktalmor Feb 6, 2025
c6a1cd3
Update data-explorer/whats-new.md
shsagir Feb 6, 2025
36a7328
Update monikerRange and include notes in docs
ktalmor Feb 6, 2025
cd087fe
Small fix
ktalmor Feb 6, 2025
5b9ee7a
Fixed link paths
ktalmor Feb 6, 2025
01dcdfa
Update data-explorer/whats-new.md
shsagir Feb 6, 2025
04cb64a
Merge pull request #6604 from ktalmor/wi-368160-KUS--What's-New-Jan-25
prmerger-automator[bot] Feb 6, 2025
6f1c5a8
Merge pull request #6583 from ktalmor/KQL-review-batch-10
JillGrant615 Feb 6, 2025
4f1d633
Merge pull request #6618 from MicrosoftDocs/repo_sync_working_branch
Taojunshen Feb 6, 2025
dc33141
Merge pull request #6620 from MicrosoftDocs/main
Taojunshen Feb 6, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions data-explorer/kusto/query/sort-operator.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,11 @@ title: sort operator
description: Learn how to use the sort operator to sort the rows of the input table by one or more columns.
ms.reviewer: alexans
ms.topic: reference
ms.date: 08/11/2024
monikerRange: "microsoft-fabric || azure-data-explorer || azure-monitor || microsoft-sentinel "
ms.date: 01/21/2025
---
# sort operator

> [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)]

> [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)]

Sorts the rows of the input table into order by one or more columns.

Expand Down Expand Up @@ -52,6 +50,8 @@ When the input table contains the special values `null`, `NaN`, `-inf` and `+inf

The following example shows storm events by state in alphabetical order with the most recent storms in each state appearing first.

[!INCLUDE [help-cluster-note](../includes/help-cluster-note.md)]

:::moniker range="azure-data-explorer"
> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAAwsuyS/KdS1LzSsp5qpRyC9KSS1SSKpUCC5JLElVSCxO1gExi0pCMnNTFVJSi5MBfa8LRzAAAAA=" target="_blank">Run the query</a>
Expand All @@ -62,6 +62,8 @@ StormEvents
| sort by State asc, StartTime desc
```

**Output**

This table only shows the top 10 query results.

|StartTime|State|EventType|...|
Expand Down
23 changes: 8 additions & 15 deletions data-explorer/kusto/query/summarize-operator.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,12 @@ title: summarize operator
description: Learn how to use the summarize operator to produce a table that summarizes the content of the input table.
ms.reviewer: alexans
ms.topic: reference
ms.date: 08/11/2024
ms.date: 01/21/2025
ms.localizationpriority: high
monikerRange: "microsoft-fabric || azure-data-explorer || azure-monitor || microsoft-sentinel "
---
# summarize operator

> [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)]

> [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)]

Produces a table that aggregates the content of the input table.

Expand All @@ -30,7 +28,7 @@ Produces a table that aggregates the content of the input table.
|*Column*| `string` ||The name for the result column. Defaults to a name derived from the expression.|
|*Aggregation*| `string` | :heavy_check_mark:|A call to an [aggregation function](aggregation-functions.md) such as `count()` or `avg()`, with column names as arguments.|
|*GroupExpression*|scalar| :heavy_check_mark:|A scalar expression that can reference the input data. The output will have as many records as there are distinct values of all the group expressions.|
|*SummarizeParameters*| `string` ||Zero or more space-separated parameters in the form of *Name* `=` *Value* that control the behavior. See [supported parameters](#supported-parameters).
|*SummarizeParameters*| `string` ||Zero or more space-separated parameters in the form of *Name* `=` *Value* that control the behavior. See [supported parameters](#supported-parameters).|

> [!NOTE]
> When the input table is empty, the output depends on whether *GroupExpression*
Expand All @@ -39,7 +37,6 @@ Produces a table that aggregates the content of the input table.
> * If *GroupExpression* is not provided, the output will be a single (empty) row.
> * If *GroupExpression* is provided, the output will have no rows.


### Supported parameters

|Name |Description |
Expand Down Expand Up @@ -78,6 +75,10 @@ The following table summarizes the default values of aggregations:

## Examples

The example in this section shows how to use the syntax to help you get started.

[!INCLUDE [help-cluster](../includes/help-cluster-note.md)]

:::image type="content" source="media/summarizeoperator/summarize-price-by-supplier.png" alt-text="Summarize price by fruit and supplier.":::

### Unique combination
Expand Down Expand Up @@ -131,6 +132,7 @@ StormEvents
| 01:08:00 | 11:55:00 |

::: moniker range="microsoft-fabric || azure-data-explorer || azure-monitor || microsoft-sentinel"

### Distinct count

The following query calculates the number of unique storm event types for each state and sorts the results by the number of unique storm types:
Expand Down Expand Up @@ -192,7 +194,6 @@ When the input of `summarize` operator doesn't have an empty group-by key, the r
> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAAz2PwQ7CIBBE7yb+A0cwHLz0YqI/YkyzBaQbAU3ZNtT48S7EGg4zmTe7WSwQvyE4WU7hmby63va7j8hzjDDh2wlIa1/OBA/Xs5VFaQGT7yMUjn9OFi0OG8C0AUx/sPg2OcwYbDajiyDpadcEEQ27TBOmWlFcagur1nnWl5uMS4T1Ri26jqMxBEZCZ7JuaSU+eFO8114RF3HkgCx6l6nBhb8EyfAe9QXbqS6i+AAAAA==" target="_blank">Run the query</a>


```kusto
datatable(x:long)[]
| summarize any_x=take_any(x), arg_max_x=arg_max(x, *), arg_min_x=arg_min(x, *), avg(x), buildschema(todynamic(tostring(x))), max(x), min(x), percentile(x, 55), hll(x) ,stdev(x), sum(x), sumif(x, x > 0), tdigest(x), variance(x)
Expand All @@ -206,11 +207,9 @@ datatable(x:long)[]

The result of `avg_x(x)` is `NaN` due to dividing by 0.


> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA0tJLAHCpJxUjQqrnPy8dM3oWF6uGoXi0tzcxKLMqlQFheT80rwSjQpNHQgrM02jQsFOwUBTQUchBSGXApfUUYDIAwDGwdg7WgAAAA==" target="_blank">Run the query</a>


```kusto
datatable(x:long)[]
| summarize count(x), countif(x > 0) , dcount(x), dcountif(x, x > 0)
Expand All @@ -222,11 +221,9 @@ datatable(x:long)[]
|---|---|---|---|
|0|0|0|0|


> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA0tJLAHCpJxUjQqrnPy8dM3oWF6uGoXi0tzcxKLMqlQFhdzE7NT44tQSjQpNHQgnJ7MYxAMATGERsTsAAAA=" target="_blank">Run the query</a>


```kusto
datatable(x:long)[]
| summarize make_set(x), make_list(x)
Expand Down Expand Up @@ -259,11 +256,9 @@ range x from 1 to 4 step 1

The regular count will count nulls:


> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAAy3KTQqAIBAG0H3QHb6lA20MWnoYqTEEf2JU0OjwEbR7iyc2nYwOJzlCo2asKJUv6Hl6wL1yOjBg4J1THcZALxC2QaUWAv3eiL5eWoxW/M3Yc0tVDXoBSiga018AAAA=" target="_blank">Run the query</a>


```kusto
range x from 1 to 2 step 1
| extend y = iff(x == 1, real(null), real(5))
Expand All @@ -276,11 +271,9 @@ range x from 1 to 2 step 1
|---|
|2|


> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA03KSwqAIBRG4XnQHv6hQhODhq4lhK4h+YirgkWLr6BBs3PgYxNXQoPlFKBQEkbkQjtU312gViguOKDhrBUNWkMNYDJexOq9/HqS8uW5hmDYnYRgNpozFXE85Dc305SXFm8AAAA=" target="_blank">Run the query</a>


```kusto
range x from 1 to 2 step 1
| extend y = iff(x == 1, real(null), real(5))
Expand Down
6 changes: 5 additions & 1 deletion data-explorer/kusto/query/visualization-anomalychart.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Anomaly chart visualization
description: This article describes the anomaly chart visualization.
ms.reviewer: alexans
ms.topic: reference
ms.date: 08/11/2024
ms.date: 01/21/2025
monikerRange: "microsoft-fabric || azure-data-explorer"
---
# Anomaly chart
Expand Down Expand Up @@ -61,6 +61,10 @@ This visualization supports splitting into multiple y-axis values. The supported

## Example

The example in this section shows how to use the syntax to help you get started.

[!INCLUDE [help-cluster](../includes/help-cluster-note.md)]

:::moniker range="azure-data-explorer"
> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA3WR3W7CMAyF73mKI25KpRbaTmjSUJ8CpF1WoXVptPxUifmb9vBLoGO7GFeR7ePv2I4ihpamYdToBBNLTYuqKF/zosyLdbqZqagQl/8UVV68oKreimLSdVFUDZtZR9o2WnxQ48lJ8tXsCzHM7yHMUdfidFiEN4U12AXoloUe0Turp4nYTsaeaYzs/RVedgis80CObkFdI9ltywTAagV4UtQyRKiZgyLEaTGZ9taFQqtIGHI4SX8USn4KltYEJF2YTIeFMFaHPPkMvrWOMuxFoEpDaVjujmo6aq0erafmIY+7ZCiX6wx5mSGJHb3kJA1sF8jB8q69toNwjLPkYfGTseqoja//eLNkRXXyTnuIcVyCneh72cL2YQdtDQ8ZHvIkDcsfPWH+3AvPvObx0FMXD/RLhfDYW9VhtNKwj/8U69M1b2S//AbRUQMWQQIAAA==" target="_blank">Run the query</a>
Expand Down
8 changes: 5 additions & 3 deletions data-explorer/kusto/query/visualization-areachart.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,7 @@ title: Area chart visualization
description: This article describes the area chart visualization.
ms.reviewer: alexans
ms.topic: reference
ms.date: 08/11/2024
monikerRange: "microsoft-fabric || azure-data-explorer || azure-monitor || microsoft-sentinel"
ms.date: 01/28/2025
---
# Area chart

Expand Down Expand Up @@ -61,7 +60,6 @@ This visualization supports splitting into multiple y-axis values:
|`axes` |A single chart is displayed with multiple y-axes (one per series).|
|`panels` |One chart is rendered for each `ycolumn` value. Maximum five panels.|


::: moniker-end

::: moniker range="azure-monitor || microsoft-sentinel"
Expand Down Expand Up @@ -92,6 +90,10 @@ The supported values of this property are:

## Examples

The example in this section shows how to use the syntax to help you get started.

[!INCLUDE [help-cluster](../includes/help-cluster-note.md)]

### Simple area chart

The following example shows a basic area chart visualization.
Expand Down
12 changes: 8 additions & 4 deletions data-explorer/kusto/query/visualization-barchart.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,7 @@ title: Bar chart visualization
description: This article describes the bar chart visualization.
ms.reviewer: alexans
ms.topic: reference
ms.date: 08/11/2024
monikerRange: "microsoft-fabric || azure-data-explorer || azure-monitor || microsoft-sentinel"
ms.date: 01/28/2025
---
# Bar chart

Expand Down Expand Up @@ -91,6 +90,10 @@ The supported values of this property are:

## Examples

The example in this section shows how to use the syntax to help you get started.

[!INCLUDE [help-cluster](../includes/help-cluster-note.md)]

### Render a bar chart

The following query creates a bar chart displaying the number of storm events for each state, filtering only those states with more than 10 events. The chart provides a visual representation of the event distribution across different states.
Expand Down Expand Up @@ -157,6 +160,8 @@ StormEvents

### Use the `ysplit` property

The following query provides a daily summary of storm-related injuries and deaths, visualized as a bar chart with split axes/panels for better comparison.

> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA1WOMQ6DMAxFd07hkagsPQAbHZjhAiFYwogkyDGlVD1800a04O1//2f/Rjzb2x2dhOwFYbFWMz0xgzitFz3VblyYMED52ea7rIjRiILLya1dn/zif6BCLcOOJ3GGk/dDv2S3QUcub0SztGSxgGuvYsGZ/RhDcFicWhbHnzHP6HpkMH5arDNDhGAlGSDfwjyRlPqBQb0BEH1UJQQBAAA=" target="_blank">Run the query</a>

Expand Down Expand Up @@ -189,5 +194,4 @@ StormEvents

:::image type="content" source="media/visualization-barchart/bar-chart-ysplit-panels.png" alt-text="Screenshot of column chart using ysplit panels property." lightbox="media/visualization-barchart/bar-chart-ysplit-panels.png":::


::: moniker-end
::: moniker-end
6 changes: 5 additions & 1 deletion data-explorer/kusto/query/visualization-card.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Card visualization
description: This article describes the card visualization.
ms.reviewer: alexans
ms.topic: reference
ms.date: 08/11/2024
ms.date: 01/28/2025
monikerRange: "microsoft-fabric || azure-data-explorer"
---
# Card
Expand Down Expand Up @@ -38,6 +38,10 @@ All properties are optional.

## Example

This query provides a count of flood events in Virginia and displays the result in a card format.

[!INCLUDE [help-cluster-note](../includes/help-cluster-note.md)]

:::moniker range="azure-data-explorer"
> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAAy2LsQqDQBAFe7/icZX5CAuLJFxjocH+8BZd0D1ZV0Xw42OC1RQz01jS6bmR2JKd2AdSQmPBqChc6+u3r3zpECTiH32O+WdeY0rRXUOXVrGLShJJ0QWN2NkG5MY20l0uYEHL2rNwcI8vTweEO3QAAAA=" target="_blank">Run the query</a>
Expand Down
14 changes: 10 additions & 4 deletions data-explorer/kusto/query/visualization-columnchart.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,7 @@ title: Column chart visualization
description: This article describes the column chart visualization.
ms.reviewer: alexans
ms.topic: reference
ms.date: 08/11/2024
monikerRange: "microsoft-fabric || azure-data-explorer || azure-monitor || microsoft-sentinel"
ms.date: 01/29/2025
---
# Column chart

Expand Down Expand Up @@ -93,13 +92,17 @@ The supported values of this property are:

## Examples

The example in this section shows how to use the syntax to help you get started.

[!INCLUDE [help-cluster](../includes/help-cluster-note.md)]

### Render a column chart

This query provides a visual representation of states with a high frequency of storm events, specifically those with more than 10 events, using a column chart.

> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAAwsuyS/KdS1LzSsp5qpRKC7NzU0syqxKVUgFCcUn55fmldiCSQ1NhaRKheCSxJJUoMLyjNQiFEUKdgqGBkCJgqL8rNTkEohCHWQVQMmi1LyU1CKF5Pyc0ty85IzEohIAvF8Py38AAAA=" target="_blank">Run the query</a>


```kusto
StormEvents
| summarize event_count=count() by State
Expand All @@ -112,6 +115,8 @@ StormEvents

### Use the `ysplit` property

This query provides a daily summary of storm-related injuries and deaths, visualized as a column chart with split axes/panels for better comparison.

> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA1WOMQ6DMAxFd07hkagsPQAbHZjhAiFYwogkyDGlVD1800a04O1//2f/Rjzb2x2dhOwFYbFWMz0xgzitFz3VblyYMED52ea7rIjRiILLya1dn/zif6BCLcOOJ3GGk/dDv2S3QUcub0SztGSxgGuvYsGZ/RhDcFicWhbHnzHP6HpkMH5arDNDhGAlGSDfwjyRlPqBQb0BEH1UJQQBAAA=" target="_blank">Run the query</a>

Expand All @@ -132,7 +137,6 @@ To split the view into separate panels, specify `panels` instead of `axes`:
> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA1WOMQ6DMAxFd07hEVSWHoCNDsxwgRAsYZQ4yDGtqHr4pkW04O1//2f/VoP42x1ZY/aCuHhvhJ6YQZouqHENT4sQRqg+23yXNQlaLeBychseNr/8H6jR6LjjmzjDm/dDv2S/Qk+ct2pEO/JYwnUoUsFZwpRCcFicWpbHnykvyAMK2OAWz3ZMEDxIR8jXODvSajaMLhZvciiM8gYBAAA=" target="_blank">Run the query</a>


```kusto
StormEvents
| summarize
Expand All @@ -151,6 +155,8 @@ StormEvents

## Example

This query helps you identify states with a significant number of storm events and presents the information in a clear, visual format.

> [!div class="nextstepaction"]
> <a href="https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAAwsuyS/KdS1LzSsp5qpRKC7NzU0syqxKVUgFCcUn55fmldiCSQ1NhaRKheCSxJJUoMLyjNQiFEUKdgqGBkCJgqL8rNTkEohCHWQVQMmi1LyU1CKF5Pyc0ty85IzEohIAvF8Py38AAAA=" target="_blank">Run the query</a>

Expand Down
14 changes: 12 additions & 2 deletions data-explorer/kusto/query/visualization-ladderchart.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Ladder chart visualization
description: This article describes the ladder chart visualization.
ms.reviewer: alexans
ms.topic: reference
ms.date: 08/11/2024
ms.date: 01/29/2025
monikerRange: "azure-data-explorer"
---
# Ladder chart
Expand All @@ -26,7 +26,7 @@ The last two columns are the x-axis, and the other columns are the y-axis.

| Name | Type | Required | Description |
| -- | -- | -- | -- |
| *T* | `string` | :heavy_check_mark: | Input table name.
| *T* | `string` | :heavy_check_mark: | Input table name|
| *propertyName*, *propertyValue* | `string` | | A comma-separated list of key-value property pairs. See [supported properties](#supported-properties).|

### Supported properties
Expand All @@ -50,8 +50,14 @@ All properties are optional.

## Examples

The example in this section shows how to use the syntax to help you get started.

The examples in this article use publicly available tables in the help cluster, such as the *StormEvents* table in the Samples database.

### Dates of storms by state

This query outputs a state-wise visualization of the duration of rain-related storm events, displayed as a ladder chart to help you analyze the temporal distribution of these events.

```kusto
StormEvents
| where EventType has "rain"
Expand All @@ -63,6 +69,8 @@ StormEvents

### Dates of storms by event type

This query outputs a visualization of the duration of various storm events in Washington, displayed as a ladder chart to help you analyze the temporal distribution of these events by type.

```kusto
StormEvents
| where State == "WASHINGTON"
Expand All @@ -74,6 +82,8 @@ StormEvents

### Dates of storms by state and event type

This query outputs a visualization of the duration of various storm events in states starting with "W", displayed as a ladder chart to help you analyze the temporal distribution of these events by state and event type.

```kusto
StormEvents
| where State startswith "W"
Expand Down
Loading