diff --git a/data-explorer/kusto/query/bag-set-key-function.md b/data-explorer/kusto/query/bag-set-key-function.md index a1548cffd1..2c71992b00 100644 --- a/data-explorer/kusto/query/bag-set-key-function.md +++ b/data-explorer/kusto/query/bag-set-key-function.md @@ -34,7 +34,7 @@ Returns a `dynamic` property-bag with specified key-value pairs. If the input ba ## Examples -### Use a root-level key +The following example demonstrates how to set a root-level key in a property bag. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -54,7 +54,8 @@ datatable(input: dynamic) [ |{
"key1": 1,
"key2": 2
}|{
"key1": 1,
"key2": 2,
"key3": 3
}| |{
"key1": 1,
"key3": "abc"
}|{
"key1": 1,
"key3": 3
}| -### Use a JSONPath key +The following example demonstrates how to set a JSONPath key in a property bag. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/bag-unpack-plugin.md b/data-explorer/kusto/query/bag-unpack-plugin.md index 5eb0db9f09..14c7809c5f 100644 --- a/data-explorer/kusto/query/bag-unpack-plugin.md +++ b/data-explorer/kusto/query/bag-unpack-plugin.md @@ -60,7 +60,7 @@ The `bag_unpack` plugin returns a table with as many records as its tabular inpu ## Examples -### Expand a bag +The following example demonstrates how to expand a bag. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -85,9 +85,7 @@ datatable(d:dynamic) |40 |Dave | |30 |Jasmine| -### Expand a bag with OutputColumnPrefix - -Expand a bag and use the `OutputColumnPrefix` option to produce column names that begin with the prefix 'Property_'. +The following example demonstrates how to expand a bag and use the `OutputColumnPrefix` option to produce column names that begin with the prefix 'Property_'. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -112,9 +110,7 @@ datatable(d:dynamic) |40 |Dave | |30 |Jasmine | -### Expand a bag with columnsConflict - -Expand a bag and use the `columnsConflict` option to resolve conflicts between existing columns and columns produced by the `bag_unpack()` operator. +The following example demonstrates how to expand a bag and use the `columnsConflict` option to resolve conflicts between existing columns and columns produced by the `bag_unpack()` operator. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -162,9 +158,8 @@ datatable(Name:string, d:dynamic) |40 |Old_name | |30 |Old_name | -### Expand a bag with ignoredProperties -Expand a bag and use the `ignoredProperties` option to ignore certain properties in the property bag. +The following example demonstrates how to expand a bag and use the `ignoredProperties` option to ignore certain properties in the property bag. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -190,9 +185,7 @@ datatable(d:dynamic) |Dave| |Jasmine| -### Expand a bag with a query-defined OutputSchema - -Expand a bag and use the `OutputSchema` option to allow various optimizations to be evaluated before running the actual query. +The following example demonstrates how to expand a bag and use the `OutputSchema` option to allow various optimizations to be evaluated before running the actual query. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -217,7 +210,7 @@ datatable(d:dynamic) |Dave | 40 | |Jasmine | 30 | -Expand a bag and use the `OutputSchema` option to allow various optimizations to be evaluated before running the actual query. Use a wildcard `*` to return all columns of the input table. +The following example demonstrates how to expand a bag and use the `OutputSchema` option to allow various optimizations to be evaluated before running the actual query. Use a wildcard `*` to return all columns of the input table. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/bag-zip.md b/data-explorer/kusto/query/bag-zip.md index 4a1f03726c..77423c06a0 100644 --- a/data-explorer/kusto/query/bag-zip.md +++ b/data-explorer/kusto/query/bag-zip.md @@ -36,7 +36,7 @@ Returns a [dynamic](scalar-data-types/dynamic.md) property-bag. ## Examples -In the following example, the array of keys and the array of values are the same length and are zipped together into a dynamic property bag. +The following example shows how to use `bag_zip()` to create a property-bag from two arrays. The first array contains the keys, and the second array contains the values. The resulting property-bag contains the keys and values zipped together. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -55,9 +55,7 @@ Data |--|--|--| | ['a','b','c'] | [1,'2',3.4] | {'a': 1,'b': '2','c': 3.4} | -### More keys than values - -In the following example, the array of keys is longer than the array of values. The missing values are filled with nulls. +The following example shows how to use `bag_zip()` when the arrays have different lengths. In this case, the resulting property-bag contains null values for the missing keys. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -76,9 +74,7 @@ Data |--|--|--| | ['a','b','c'] | [1,'2'] | {'a': 1,'b': '2','c': null} | -### More values than keys - -In the following example, the array of values is longer than the array of keys. Values with no matching keys are ignored. +The following example shows how to use `bag_zip()` when the arrays have different lengths. In this case, the resulting property-bag contains null values for the missing keys. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -97,9 +93,7 @@ Data |--|--|--| | ['a','b'] | [1,'2',2.5] | {'a': 1,'b': '2'} | -### Non-string keys - -In the following example, there are some values in they keys array that aren't of type string. The non-string values are ignored. +The following example demonstrates how `bag_zip()` handles cases where the keys array contains non-string values. Any key that isn't a string is excluded from the resulting property-bag. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -118,9 +112,7 @@ Data |--|--|--| | ['a',8,'b'] | [1,'2',2.5] | {'a': 1,'b': 2.5} | -### Fill values with null - -In the following example, the parameter that is supposed to be an array of values isn't an array, so all values are filled with nulls. +The following example demonstrates how `bag_zip()` behaves when the parameter intended to be an array of values is not actually an array. In this case, all resulting property values are set to null. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -139,9 +131,7 @@ Data |--|--|--| | ['a',8,'b'] | 1 | {'a': null,'b': null} | -### Null property-bag - -In the following example, the parameter that is supposed to be an array of keys isn't an array, so the resulting property-bag is null. +The following example demonstrates how `bag_zip()` behaves when the parameter intended to be an array of keys is not actually an array. In this case, the resulting property-bag is null. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/base64-decode-toarray-function.md b/data-explorer/kusto/query/base64-decode-toarray-function.md index c6e187a919..6ac25ffcd7 100644 --- a/data-explorer/kusto/query/base64-decode-toarray-function.md +++ b/data-explorer/kusto/query/base64-decode-toarray-function.md @@ -27,7 +27,9 @@ Decodes a base64 string to an array of long values. Returns an array of long values decoded from a base64 string. -## Example +## Examples + +The following example shows how to use `base64_decode_toarray()` to decode a base64 string into an array of long values. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/base64-decode-toguid-function.md b/data-explorer/kusto/query/base64-decode-toguid-function.md index e9cf0e2ce4..d4b4843e5c 100644 --- a/data-explorer/kusto/query/base64-decode-toguid-function.md +++ b/data-explorer/kusto/query/base64-decode-toguid-function.md @@ -27,7 +27,9 @@ Decodes a base64 string to a [GUID](scalar-data-types/guid.md). Returns a [GUID](scalar-data-types/guid.md) decoded from a base64 string. -## Example +## Examples + +The following example shows how to use `base64_decode_toguid()` to decode a base64 string into a GUID. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/base64-decode-tostring-function.md b/data-explorer/kusto/query/base64-decode-tostring-function.md index f6a6906752..df743dbf3f 100644 --- a/data-explorer/kusto/query/base64-decode-tostring-function.md +++ b/data-explorer/kusto/query/base64-decode-tostring-function.md @@ -29,7 +29,9 @@ Decodes a base64 string to a UTF-8 string. Returns UTF-8 string decoded from base64 string. -## Example +## Examples + +The following example shows how to use `base64_decode_tostring()` to decode a base64 string into a UTF-8 string. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/base64-encode-fromarray-function.md b/data-explorer/kusto/query/base64-encode-fromarray-function.md index 8bd1b1fe1b..f77639fdde 100644 --- a/data-explorer/kusto/query/base64-encode-fromarray-function.md +++ b/data-explorer/kusto/query/base64-encode-fromarray-function.md @@ -29,6 +29,8 @@ Returns the base64 string encoded from the bytes array. Note that byte is an int ## Examples +The following example shows how to use `base64_encode_fromarray()` to encode a bytes array into a base64 string. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query diff --git a/data-explorer/kusto/query/base64-encode-fromguid-function.md b/data-explorer/kusto/query/base64-encode-fromguid-function.md index 243c564aa5..0640daa7ff 100644 --- a/data-explorer/kusto/query/base64-encode-fromguid-function.md +++ b/data-explorer/kusto/query/base64-encode-fromguid-function.md @@ -27,7 +27,9 @@ Encodes a [GUID](scalar-data-types/guid.md) to a base64 string. Returns a base64 string encoded from a GUID. -## Example +## Examples + +The following example shows how to use `base64_encode_fromguid()` to encode a GUID into a base64 string. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/base64-encode-tostring-function.md b/data-explorer/kusto/query/base64-encode-tostring-function.md index 58c28cc6ff..dee84ffe7a 100644 --- a/data-explorer/kusto/query/base64-encode-tostring-function.md +++ b/data-explorer/kusto/query/base64-encode-tostring-function.md @@ -29,7 +29,9 @@ Encodes a string as base64 string. Returns *string* encoded as a base64 string. -## Example +## Examples + +The following example shows how to use `base64_encode_tostring()` to encode a string into a base64 string. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/basket-plugin.md b/data-explorer/kusto/query/basket-plugin.md index 512136e867..316e0e4e19 100644 --- a/data-explorer/kusto/query/basket-plugin.md +++ b/data-explorer/kusto/query/basket-plugin.md @@ -38,7 +38,9 @@ Each pattern is represented by a row in the results. The first column is the seg > [!NOTE] > The algorithm uses sampling to determine the initial frequent values. Therefore, the results could slightly differ between multiple runs for patterns whose frequency is close to the threshold. -## Example +## Examples + +The following example uses the `basket` plugin to find frequent patterns in the data. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -66,7 +68,7 @@ StormEvents |6|1310|22.3|||YES| |7|1291|21.9||Thunderstorm Wind|| -### Example with custom wildcards +The following example demonstrates using the `basket` plugin with a weight column and custom wildcards to find frequent patterns. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/between-operator.md b/data-explorer/kusto/query/between-operator.md index a7be5793b9..9fcfee511b 100644 --- a/data-explorer/kusto/query/between-operator.md +++ b/data-explorer/kusto/query/between-operator.md @@ -26,7 +26,7 @@ Filters a record set for data matching the values in an inclusive range. | *T* | `string` | :heavy_check_mark: | The tabular input whose records are to be matched. For example, the table name. | | *expr* | scalar | :heavy_check_mark: | The expression used to filter. | | *leftRange* | int, long, real, or datetime | :heavy_check_mark: | The expression of the left range. The range is inclusive.| -| *rightRange* | int, long, real, datetime, or timespan | :heavy_check_mark: | The expression of the right range. The range is inclusive.

This value can only be of type [timespan](scalar-data-types/timespan.md) if *expr* and *leftRange* are both of type `datetime`. See [example](#filter-using-a-timespan-range).| +| *rightRange* | int, long, real, datetime, or timespan | :heavy_check_mark: | The expression of the right range. The range is inclusive.

This value can only be of type [timespan](scalar-data-types/timespan.md) if *expr* and *leftRange* are both of type `datetime`. See [examples](#examples).| ## Returns @@ -34,7 +34,7 @@ Rows in *T* for which the predicate of (*expr* >= *leftRange* and *expr* <= *rig ## Examples -### Filter numeric values +In the following example, the rows are filtered by numeric values. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -57,7 +57,7 @@ range x from 1 to 100 step 1 |54| |55| -### Filter by date +In the following example, the rows are filtered by date. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -76,7 +76,7 @@ StormEvents |---| |476| -### Filter by date and time +In the following example, the rows are filtered by date and time. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -95,7 +95,7 @@ StormEvents |---| |301| -### Filter using a timespan range +In the following example, the rows are filtered using a timespan range. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/bitset-count-ones-function.md b/data-explorer/kusto/query/bitset-count-ones-function.md index f48f329369..12a0b76f29 100644 --- a/data-explorer/kusto/query/bitset-count-ones-function.md +++ b/data-explorer/kusto/query/bitset-count-ones-function.md @@ -9,7 +9,8 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Returns the number of set bits in the binary representation of a number. +Performs a bitwise operation on the binary representation of a number. + ## Syntax @@ -27,7 +28,7 @@ Returns the number of set bits in the binary representation of a number. Returns the number of set bits in the binary representation of a number. -## Example +## Examples :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/buildschema-aggregation-function.md b/data-explorer/kusto/query/buildschema-aggregation-function.md index 6dda61c1c2..764c7010e1 100644 --- a/data-explorer/kusto/query/buildschema-aggregation-function.md +++ b/data-explorer/kusto/query/buildschema-aggregation-function.md @@ -32,7 +32,7 @@ Returns the minimal schema that admits all values of *DynamicExpr*. > [!TIP] > If the input is a JSON string, use the [parse_json()](parse-json-function.md) function to convert the JSON to a [dynamic](scalar-data-types/dynamic.md) value. Otherwise, an error might occur. -## Example +## Examples The following example builds a schema based on: @@ -54,7 +54,7 @@ datatable(value: dynamic) [ | summarize buildschema(value) ``` -**Results** +**Output** |schema_value| |--| diff --git a/data-explorer/kusto/query/case-function.md b/data-explorer/kusto/query/case-function.md index f8a539f64b..a46cdd094c 100644 --- a/data-explorer/kusto/query/case-function.md +++ b/data-explorer/kusto/query/case-function.md @@ -35,7 +35,7 @@ All `then` arguments and the `else` argument must be of the same type. The value of the first *then_i* whose *predicate_i* evaluates to `true`, or the value of *else* if neither of the predicates are satisfied. -## Example +## Examples :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/cluster-function.md b/data-explorer/kusto/query/cluster-function.md index e1e3c1e685..939f94b0d4 100644 --- a/data-explorer/kusto/query/cluster-function.md +++ b/data-explorer/kusto/query/cluster-function.md @@ -42,9 +42,8 @@ Changes the reference of the query to a remote Eventhouse. To access a database ## Examples :::moniker range="azure-data-explorer" -### Use cluster() to access remote cluster - -The following query can be run on any cluster. +The following example shows how to use the `cluster()` function to access a remote cluster. +The query can be run on any cluster. > [!div class="nextstepaction"] > Run the query @@ -57,9 +56,9 @@ cluster('help.kusto.windows.net').database('Samples').StormEvents | count :::moniker-end :::moniker range="microsoft-fabric" -### Use cluster() to access remote Eventhouse -The following query can be run on any Eventhouse. +The following example shows how to use the `cluster()` function to access a remote Eventhouse. +The query can be run on any Eventhouse. ```kusto cluster('help').database('Samples').StormEvents | count @@ -74,7 +73,6 @@ cluster('help.kusto.windows.net').database('Samples').StormEvents | count |---| |59066| -### Use cluster() inside let statements The previous query can be rewritten to use a query-defined function (`let` statement) that takes a parameter called `clusterName` and passes it to the `cluster()` function. @@ -97,7 +95,6 @@ foo('help') |---| |59066| -### Use cluster() inside Functions The same query as above can be rewritten to be used in a function that receives a parameter `clusterName` - which is passed into the cluster() function. diff --git a/data-explorer/kusto/query/coalesce-function.md b/data-explorer/kusto/query/coalesce-function.md index e2fdcef04d..59196ccefb 100644 --- a/data-explorer/kusto/query/coalesce-function.md +++ b/data-explorer/kusto/query/coalesce-function.md @@ -32,7 +32,7 @@ Evaluates a list of expressions and returns the first non-null (or non-empty for The value of the first *arg* whose value isn't null (or not-empty for string expressions). -## Example +## Examples :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/column-ifexists-function.md b/data-explorer/kusto/query/column-ifexists-function.md index be8e48cc0b..d0e2378c61 100644 --- a/data-explorer/kusto/query/column-ifexists-function.md +++ b/data-explorer/kusto/query/column-ifexists-function.md @@ -30,7 +30,7 @@ Displays the column, if the column exists. Otherwise, it returns the default col If *columnName* exists, then returns the column. Otherwise, it returns the *defaultValue* column. -## Example +## Examples This example returns the default **State** column, because a column named Capital doesn't exist in the *StormEvents* table. diff --git a/data-explorer/kusto/query/comment.md b/data-explorer/kusto/query/comment.md index e264b7a14a..937f96e7b5 100644 --- a/data-explorer/kusto/query/comment.md +++ b/data-explorer/kusto/query/comment.md @@ -27,9 +27,9 @@ Use the two slashes (//) to add comments. The following table lists the keyboard | `Ctrl`+`K`+`C` | Comment current line or selected lines. | | `Ctrl`+`K`+`U` | Uncomment current line or selected lines. | -## Example +## Examples -This example returns a count of events in the New York state: +The following example illustrates two styles of comments: a nested comment at the end of a line and a standalone comment on its own line. The query counts the number of events in the state of New York. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/consume-operator.md b/data-explorer/kusto/query/consume-operator.md index c2decdfa0b..6105a0a473 100644 --- a/data-explorer/kusto/query/consume-operator.md +++ b/data-explorer/kusto/query/consume-operator.md @@ -31,3 +31,21 @@ data between the nodes of the cluster.) |Name|Type|Required|Description| |--|--|--|--| | *DecodeBlocks* | `bool` | | If set to `true`, or if the request property `perftrace` is set to `true`, the `consume` operator won't just enumerate the records at its input, but actually force each value in those records to be decompressed and decoded.| + +## Example + +The following example consumes the results of a query without returning any data to the client. + +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + +```kusto +StormEvents +| where State == "TEXAS" +| consume +``` + +**Output** +No rows to show. diff --git a/data-explorer/kusto/query/contains-cs-operator.md b/data-explorer/kusto/query/contains-cs-operator.md index f7dd92cd2e..0af0f09c97 100644 --- a/data-explorer/kusto/query/contains-cs-operator.md +++ b/data-explorer/kusto/query/contains-cs-operator.md @@ -37,7 +37,9 @@ If you're looking for a [term](datatypes-string-operators.md#what-is-a-term), us Rows in *T* for which *string* is in *col*. -## Example +## Examples + +The following example demonstrates how to use the `contains_cs` operator. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/contains-operator.md b/data-explorer/kusto/query/contains-operator.md index b7c527b1a1..201a388408 100644 --- a/data-explorer/kusto/query/contains-operator.md +++ b/data-explorer/kusto/query/contains-operator.md @@ -39,7 +39,9 @@ If you're looking for a [term](datatypes-string-operators.md#what-is-a-term), us Rows in *T* for which *string* is in *col*. -## Example +## Examples + +The following example demonstrates how to use the `contains` operator. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/convert-angle-function.md b/data-explorer/kusto/query/convert-angle-function.md index 76e6f9c53b..d5da77aca3 100644 --- a/data-explorer/kusto/query/convert-angle-function.md +++ b/data-explorer/kusto/query/convert-angle-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Convert an angle value from one unit to another. +Converts an angle value from one unit to another. ## Syntax @@ -48,8 +48,10 @@ Convert an angle value from one unit to another. Returns the input value converted from one angle unit to another. Invalid units return `null`. -## Example +## Examples +The following example demonstrates how to use the `convert_angle()` function. +` :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query diff --git a/data-explorer/kusto/query/convert-energy-function.md b/data-explorer/kusto/query/convert-energy-function.md index c864207844..c87dd50a8f 100644 --- a/data-explorer/kusto/query/convert-energy-function.md +++ b/data-explorer/kusto/query/convert-energy-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Convert an energy value from one unit to another. +Converts an energy value from one unit to another. ## Syntax @@ -68,7 +68,9 @@ Convert an energy value from one unit to another. Returns the input value converted from one energy unit to another. Invalid units return `null`. -## Example +## Examples + +The following example demonstrates how to use the `convert_energy()` function. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/convert-force-function.md b/data-explorer/kusto/query/convert-force-function.md index 261d5d0cc2..af15345d60 100644 --- a/data-explorer/kusto/query/convert-force-function.md +++ b/data-explorer/kusto/query/convert-force-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Convert a force value from one unit to another. +Converts a force value from one unit to another. ## Syntax @@ -47,7 +47,9 @@ Convert a force value from one unit to another. Returns the input value converted from one force unit to another. Invalid units return `null`. -## Example +## Examples + +The following example demonstrates how to use the `convert_force()` function. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/convert-length-function.md b/data-explorer/kusto/query/convert-length-function.md index d01aadac6f..7188efd11e 100644 --- a/data-explorer/kusto/query/convert-length-function.md +++ b/data-explorer/kusto/query/convert-length-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Convert a length value from one unit to another. +Converts a length value from one unit to another. ## Syntax @@ -68,7 +68,9 @@ Convert a length value from one unit to another. Returns the input value converted from one length unit to another. Invalid units return `null`. -## Example +## Examples + +The following example demonstrates how to use the `convert_length()` function. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/convert-mass-function.md b/data-explorer/kusto/query/convert-mass-function.md index c0a5dbacfb..71fdb110c3 100644 --- a/data-explorer/kusto/query/convert-mass-function.md +++ b/data-explorer/kusto/query/convert-mass-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Convert a mass value from one unit to another. +Converts a mass value from one unit to another. ## Syntax @@ -57,7 +57,9 @@ Convert a mass value from one unit to another. Returns the input value converted from one mass unit to another. Invalid units return `null`. -## Example +## Examples + +The following example demonstrates how to use the `convert_mass()` function. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/convert-speed-function.md b/data-explorer/kusto/query/convert-speed-function.md index 33f63eb0e7..5af9d2f58a 100644 --- a/data-explorer/kusto/query/convert-speed-function.md +++ b/data-explorer/kusto/query/convert-speed-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Convert a speed value from one unit to another. +Converts a speed value from one unit to another. ## Syntax @@ -64,7 +64,9 @@ Convert a speed value from one unit to another. Returns the input value converted from one speed unit to another. Invalid units return `null`. -## Example +## Examples + +The following example demonstrates how to use the `convert_speed()` function. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/convert-temperature-function.md b/data-explorer/kusto/query/convert-temperature-function.md index 6bdafaf74d..90cb958f54 100644 --- a/data-explorer/kusto/query/convert-temperature-function.md +++ b/data-explorer/kusto/query/convert-temperature-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Convert a temperature value from one unit to another. +Converts a temperature value from one unit to another. ## Syntax @@ -42,7 +42,9 @@ Convert a temperature value from one unit to another. Returns the input value converted from one temperature unit to another. Invalid units return `null`. -## Example +## Examples + +The following example demonstrates how to use the `convert_temperature()` function. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/convert-volume-function.md b/data-explorer/kusto/query/convert-volume-function.md index 7226068db8..869f892136 100644 --- a/data-explorer/kusto/query/convert-volume-function.md +++ b/data-explorer/kusto/query/convert-volume-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Convert a volume value from one unit to another. +Converts a volume value from one unit to another. ## Syntax @@ -84,7 +84,9 @@ Convert a volume value from one unit to another. Returns the input value converted from one volume unit to another. Invalid units return `null`. -## Example +## Examples + +The following example demonstrates how to use the `convert_volume()` function. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/cos-function.md b/data-explorer/kusto/query/cos-function.md index 443eb57066..16daa00bf5 100644 --- a/data-explorer/kusto/query/cos-function.md +++ b/data-explorer/kusto/query/cos-function.md @@ -9,7 +9,8 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Returns the cosine function value of the specified angle. The angle is specified in radians. +Performs a cosine operation on the input value. +The angle is specified in radians. ## Syntax @@ -27,7 +28,9 @@ Returns the cosine function value of the specified angle. The angle is specified The cosine of *number* of radians. -## Example +## Examples + +The following example demonstrates how to use the `cos()` function. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/cosmosdb-plugin.md b/data-explorer/kusto/query/cosmosdb-plugin.md index e34576884f..d4339a4697 100644 --- a/data-explorer/kusto/query/cosmosdb-plugin.md +++ b/data-explorer/kusto/query/cosmosdb-plugin.md @@ -113,7 +113,7 @@ evaluate cosmosdb_sql_request( | where lastName == 'Smith' ``` -### Query Azure Cosmos DB and join data with a database table +### Query Azure Cosmos DB with a database table The following example joins partner data from an Azure Cosmos DB with partner data in a database using the `Partner` field. It results in a list of partners with their phone numbers, website, and contact email address sorted by partner name. diff --git a/data-explorer/kusto/query/current-principal-function.md b/data-explorer/kusto/query/current-principal-function.md index 4b90c207f0..cca68b0dfe 100644 --- a/data-explorer/kusto/query/current-principal-function.md +++ b/data-explorer/kusto/query/current-principal-function.md @@ -10,7 +10,7 @@ monikerRange: "microsoft-fabric || azure-data-explorer" > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Returns the current principal name that runs the query. +Provides the current principal name that runs the query. ## Syntax @@ -24,7 +24,9 @@ The current principal fully qualified name (FQN) as a `string`. The string format is: *PrinciplaType*`=`*PrincipalId*`;`*TenantId* -## Example +## Examples + +The following example returns the current principal name. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -35,7 +37,7 @@ The string format is: print fqn=current_principal() ``` -**Example output** +**Output** |fqn| |---| diff --git a/data-explorer/kusto/query/cursor-after-function.md b/data-explorer/kusto/query/cursor-after-function.md index f59999e2b3..9b584943d9 100644 --- a/data-explorer/kusto/query/cursor-after-function.md +++ b/data-explorer/kusto/query/cursor-after-function.md @@ -10,7 +10,7 @@ monikerRange: "microsoft-fabric || azure-data-explorer" > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -A predicate run over the records of a table to compare their ingestion time against a database cursor. +A predicate runs over the records of a table to compare their ingestion time against a database cursor. > [!NOTE] > This function can only be invoked on records of a table that has the @@ -30,10 +30,21 @@ A predicate run over the records of a table to compare their ingestion time agai ## Returns -A scalar value of type `bool` that indicates whether the record was ingested +Returns a scalar value of type `bool` that indicates whether the record was ingested after the database cursor *RHS* (`true`) or not (`false`). +## Examples + +The following example retrieves records ingested after a specific database cursor. + +```kusto +MyTable +| where cursor_after('2024-08-01T00:00:00Z') +``` + +**Output** +The output includes all records from `MyTable` that were ingested after the specified date, August 1, 2024. + ## Related content * [database cursors](../management/database-cursor.md) - diff --git a/data-explorer/kusto/query/cursor-before-or-at-function.md b/data-explorer/kusto/query/cursor-before-or-at-function.md index 2f31bcc941..dafd582d3f 100644 --- a/data-explorer/kusto/query/cursor-before-or-at-function.md +++ b/data-explorer/kusto/query/cursor-before-or-at-function.md @@ -10,7 +10,7 @@ monikerRange: "microsoft-fabric || azure-data-explorer" > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -A predicate function run over the records of a table to compare their ingestion time against the database cursor time. +A predicate function runs over the records of a table to compare their ingestion time against the database cursor time. > [!NOTE] > This function can only be invoked on records of a table that has the @@ -30,10 +30,22 @@ A predicate function run over the records of a table to compare their ingestion ## Returns -A scalar value of type `bool` that indicates whether the record was ingested +Returns a scalar value of type `bool` that indicates whether the record was ingested before or at the database cursor *RHS* (`true`) or not (`false`). -## Related content +## Examples + +The following example retrieves records ingested before or at a specific database cursor. + +```kusto +MyTable +| where cursor_before_or_at('2024-08-01T12:00:00Z') +``` +**Output** +The output includes all records from `MyTable` that were ingested before or at the specified date, August 1, 2024, at 12:00 PM UTC. +This filters 'MyTable' to only include the records ingested before or at the specified cursor time. + +## Related content * [database cursors](../management/database-cursor.md) diff --git a/data-explorer/kusto/query/cursor-current.md b/data-explorer/kusto/query/cursor-current.md index 9350271c33..6495449ac9 100644 --- a/data-explorer/kusto/query/cursor-current.md +++ b/data-explorer/kusto/query/cursor-current.md @@ -25,6 +25,23 @@ Retrieves the current value of the cursor of the database in scope. Returns a single value of type `string` that encodes the current value of the cursor of the database in scope. +## Examples + +The following example retrieves the current cursor value for the database. + +```kusto +// Retrieve the current cursor value for the database +print CurrentCursor = cursor_current() +``` + +**Output** + +|CurrentCursor| +|---| +|2024-08-01T12:00:00Z| + +The output includes the current cursor value for the database, which is `2024-08-01T12:00:00Z`. + ## Related content * [database cursors](../management/database-cursor.md) diff --git a/data-explorer/kusto/query/database-cursor.md b/data-explorer/kusto/query/database-cursor.md index c9fa7043b6..e996fe4d2e 100644 --- a/data-explorer/kusto/query/database-cursor.md +++ b/data-explorer/kusto/query/database-cursor.md @@ -62,7 +62,9 @@ Querying a table based on database cursors is only guaranteed to "work" (providi When the extents are moved into the target table, the assigned cursor value might already have been processed, and the next query by the database cursor will miss the new records. -## Example: Processing records exactly once +## Examples: +T +he following examples demonstrates how to process records exactly once. For a table `Employees` with schema `[Name, Salary]`, to continuously process new records as they're ingested into the table, use the following process: diff --git a/data-explorer/kusto/query/database-function.md b/data-explorer/kusto/query/database-function.md index e947993e21..83bc2f707e 100644 --- a/data-explorer/kusto/query/database-function.md +++ b/data-explorer/kusto/query/database-function.md @@ -42,7 +42,7 @@ Changes the reference of the query to a specific database within the Eventhouse ## Examples -### Use database() to access table of other database +The following example counts the records in the `StormEvents` table of the `Samples` database. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -59,10 +59,7 @@ database('Samples').StormEvents | count |---| |59066| -### Use database() inside let statements - -The query above can be rewritten as a query-defined function (let statement) that -receives a parameter `dbName` - which is passed into the database() function. +The query above can be rewritten as a query-defined function (let statement) that receives a parameter `dbName` - which is passed into the database() function. ```kusto let foo = (dbName:string) @@ -78,8 +75,6 @@ foo('help') |---| |59066| -### Use database() inside stored functions - The same query as above can be rewritten to be used in a function that receives a parameter `dbName` - which is passed into the database() function. @@ -99,4 +94,3 @@ receives a parameter `dbName` - which is passed into the database() function. > [!NOTE] > Such functions can be used only locally and not in the cross-Eventhouse query. :::moniker-end - diff --git a/data-explorer/kusto/query/datatable-operator.md b/data-explorer/kusto/query/datatable-operator.md index fb3c32721d..4abb002c7a 100644 --- a/data-explorer/kusto/query/datatable-operator.md +++ b/data-explorer/kusto/query/datatable-operator.md @@ -9,7 +9,7 @@ ms.date: 01/21/2025 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Returns a table whose schema and values are defined in the query itself. +Creates a table whose schema and values are defined in the query itself. > [!NOTE] > This operator doesn't have a pipeline input. @@ -33,11 +33,11 @@ Returns a table whose schema and values are defined in the query itself. ## Returns -This operator returns a data table of the given schema and data. +Returns a data table of the given schema and data. -## Example +## Examples -This example creates a table with *Date*, *Event*, and *MoreData* columns, filters rows with Event descriptions longer than 4 characters, and adds a new column *key2* to each row from the MoreData dynamic object. +The following example creates a table with *Date*, *Event*, and *MoreData* columns, filters rows with Event descriptions longer than 4 characters, and adds a new column *key2* to each row from the MoreData dynamic object. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/datetime-add-function.md b/data-explorer/kusto/query/datetime-add-function.md index 3f682571f4..68b7fba88a 100644 --- a/data-explorer/kusto/query/datetime-add-function.md +++ b/data-explorer/kusto/query/datetime-add-function.md @@ -41,11 +41,12 @@ Possible values of *period*: ## Returns -A [datetime](scalar-data-types/datetime.md) after a certain time/date interval has been added. +Returns a [datetime](scalar-data-types/datetime.md) after a certain time/date interval has been added. ## Examples -### Period +The following example shows how to add a period to a [datetime](scalar-data-types/datetime.md) value with the `datetime_add` function. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -68,7 +69,7 @@ second = datetime_add('second',1,make_datetime(2017,1,1)) |---|---|---|---|---|---|---|---| |2018-01-01 00:00:00.0000000|2017-04-01 00:00:00.0000000|2017-02-01 00:00:00.0000000|2017-01-08 00:00:00.0000000|2017-01-02 00:00:00.0000000|2017-01-01 01:00:00.0000000|2017-01-01 00:01:00.0000000|2017-01-01 00:00:01.0000000| -### Amount +The following example demonstrates how to use the `datetime_add` function to add or subtract time intervals from a specific date. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/datetime-diff-function.md b/data-explorer/kusto/query/datetime-diff-function.md index 5e8a43f6a4..002001d48b 100644 --- a/data-explorer/kusto/query/datetime-diff-function.md +++ b/data-explorer/kusto/query/datetime-diff-function.md @@ -43,9 +43,11 @@ These values are case insensitive: ## Returns -An integer that represents the amount of *periods* in the result of subtraction (*datetime1* - *datetime2*). +Returns an integer that represents the amount of *periods* in the result of subtraction (*datetime1* - *datetime2*). -## Example +## Examples + +The following example shows how to calculate the period between two [datetime](scalar-data-types/datetime.md) values with the `datetime_diff` function. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/datetime-list-timezones.md b/data-explorer/kusto/query/datetime-list-timezones.md index d7062181d1..665c140aa2 100644 --- a/data-explorer/kusto/query/datetime-list-timezones.md +++ b/data-explorer/kusto/query/datetime-list-timezones.md @@ -7,7 +7,7 @@ ms.date: 08/11/2024 --- # datetime_list_timezones() -Returns a list of supported timezones [a time-zone specification](timezone.md). +Provides a list of supported timezones [a time-zone specification](timezone.md). ## Syntax @@ -19,9 +19,11 @@ None, the function doesn't have any parameters. ## Returns -A list of timezones supported by the [Internet Assigned Numbers Authority (IANA) Time Zone Database](https://www.iana.org/time-zones). +Returns a list of timezones supported by the [Internet Assigned Numbers Authority (IANA) Time Zone Database](https://www.iana.org/time-zones). -## Example +## Examples + +The following example shows how to get a list of all supported timezones. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/diffpatterns-plugin.md b/data-explorer/kusto/query/diffpatterns-plugin.md index a3984c9a19..50e8a6cfe2 100644 --- a/data-explorer/kusto/query/diffpatterns-plugin.md +++ b/data-explorer/kusto/query/diffpatterns-plugin.md @@ -63,7 +63,9 @@ For each pattern, columns that aren't set in the pattern (that is, without restr > * Use [where](where-operator.md) and [project](project-operator.md) in the input pipe to reduce the data to just what you're interested in. > * When you find an interesting row, you might want to drill into it further by adding its specific values to your `where` filter. -## Example +## Examples + +The following example shows how to use the `diffpatterns` plugin to analyze the StormEvents dataset. It compares events that occurred in May, focusing on the differences between events with and without damage. The query uses the `diffpatterns` plugin to identify patterns that distinguish between these two groups based on the columns State, EventType, Source, and DamageCrops. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/diffpatterns-text-plugin.md b/data-explorer/kusto/query/diffpatterns-text-plugin.md index 066534ca76..5a066d56c5 100644 --- a/data-explorer/kusto/query/diffpatterns-text-plugin.md +++ b/data-explorer/kusto/query/diffpatterns-text-plugin.md @@ -42,7 +42,9 @@ The result of diffpatterns_text returns the following columns: > [!NOTE] > The patterns aren't necessarily distinct and may not provide full coverage of the dataset. The patterns may be overlapping and some rows may not match any pattern. -## Example +## Examples + +The following example shows how to use the `diffpatterns_text` plugin to find patterns in the `EpisodeNarrative` column of the `StormEvents` table. The example compares the text patterns of the `EpisodeNarrative` column when the `EventType` is "Extreme Cold/Wind Chill" and when it is not. :::moniker range="azure-data-explorer" The following example uses data from the StormEvents table in the help cluster. To access this data, sign in to [https://dataexplorer.azure.com/clusters/help/databases/Samples](https://dataexplorer.azure.com/clusters/help/databases/Samples). In the left menu, browse to **help** > **Samples** > **Tables** > **Storm_Events**. diff --git a/data-explorer/kusto/query/dynamic-to-json-function.md b/data-explorer/kusto/query/dynamic-to-json-function.md index 7653feba00..1c228f2469 100644 --- a/data-explorer/kusto/query/dynamic-to-json-function.md +++ b/data-explorer/kusto/query/dynamic-to-json-function.md @@ -40,7 +40,9 @@ according to the following rules: of the properties. The pairs are sorted by the names, and the values are in the canonical representation described here of each array element. -## Example +## Examples + +The following example converts a `dynamic` value to a canonical string representation. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/endofday-function.md b/data-explorer/kusto/query/endofday-function.md index 6eac1a09b3..3faf953a02 100644 --- a/data-explorer/kusto/query/endofday-function.md +++ b/data-explorer/kusto/query/endofday-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Returns the end of the day containing the date, shifted by an offset, if provided. +Provides the end of the day containing the date, shifted by an offset, if provided. ## Syntax @@ -26,9 +26,11 @@ Returns the end of the day containing the date, shifted by an offset, if provide ## Returns -A datetime representing the end of the day for the given *date* value, with the *offset*, if specified. +Returns a datetime representing the end of the day for the given *date* value, with the *offset*, if specified. -## Example +## Examples + +The following example returns the end of the day for the specified date. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/endofmonth-function.md b/data-explorer/kusto/query/endofmonth-function.md index 5dcf0693d6..6353728fa4 100644 --- a/data-explorer/kusto/query/endofmonth-function.md +++ b/data-explorer/kusto/query/endofmonth-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Returns the end of the month containing the date, shifted by an offset, if provided. +Provides the end of the month containing the date, shifted by an offset, if provided. ## Syntax @@ -26,9 +26,11 @@ Returns the end of the month containing the date, shifted by an offset, if provi ## Returns -A datetime representing the end of the month for the given *date* value, with the *offset*, if specified. +Returns a datetime representing the end of the month for the given *date* value, with the *offset*, if specified. -## Example +## Examples + +The following example returns the end of the month for the specified date. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/endofweek-function.md b/data-explorer/kusto/query/endofweek-function.md index 45db6226f9..45a4b16251 100644 --- a/data-explorer/kusto/query/endofweek-function.md +++ b/data-explorer/kusto/query/endofweek-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Returns the end of the week containing the date, shifted by an offset, if provided. +Provides the end of the week containing the date, shifted by an offset, if provided. Last day of the week is considered to be a Saturday. @@ -28,9 +28,11 @@ Last day of the week is considered to be a Saturday. ## Returns -A datetime representing the end of the week for the given *date* value, with the *offset*, if specified. +Returns datetime representing the end of the week for the given *date* value, with the *offset*, if specified. -## Example +## Examples + +The following example returns the end of the week for the specified date. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/endofyear-function.md b/data-explorer/kusto/query/endofyear-function.md index 2f5d1ce885..b0f380a553 100644 --- a/data-explorer/kusto/query/endofyear-function.md +++ b/data-explorer/kusto/query/endofyear-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Returns the end of the year containing the date, shifted by an offset, if provided. +Provides the end of the year containing the date, shifted by an offset, if provided. ## Syntax @@ -26,9 +26,11 @@ Returns the end of the year containing the date, shifted by an offset, if provid ## Returns -A datetime representing the end of the year for the given *date* value, with the &*offset*, if specified. +Returns a datetime representing the end of the year for the given *date* value, with the &*offset*, if specified. -## Example +## Examples + +The following example returns the end of the year for the specified date. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/endswith-cs-operator.md b/data-explorer/kusto/query/endswith-cs-operator.md index 636fd6901c..893110baa8 100644 --- a/data-explorer/kusto/query/endswith-cs-operator.md +++ b/data-explorer/kusto/query/endswith-cs-operator.md @@ -33,9 +33,11 @@ Filters a record set for data with a case-sensitive ending string. ## Returns -Rows in *T* for which the predicate is `true`. +Returns the rows in *T* for which the predicate is `true`. -## Example +## Examples + +The following example returns the rows in the *StormEvents* table where the *State* column ends with "NA". This is a case-sensitive search. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/endswith-operator.md b/data-explorer/kusto/query/endswith-operator.md index f82e19db3c..f8de2124ec 100644 --- a/data-explorer/kusto/query/endswith-operator.md +++ b/data-explorer/kusto/query/endswith-operator.md @@ -35,9 +35,11 @@ For faster results, use the case-sensitive version of an operator. For example, ## Returns -Rows in *T* for which the predicate is `true`. +Returns the rows in *T* for which the predicate is `true`. -## Example +## Examples + +The following example returns the rows in the *StormEvents* table where the *State* column ends with "SAS". :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/equals-cs-operator.md b/data-explorer/kusto/query/equals-cs-operator.md index 127021792d..26a25ed47c 100644 --- a/data-explorer/kusto/query/equals-cs-operator.md +++ b/data-explorer/kusto/query/equals-cs-operator.md @@ -42,9 +42,11 @@ For more information about other operators and to determine which operator is mo ## Returns -Rows in *T* for which the predicate is `true`. +Returns the rows in *T* for which the predicate is `true`. -## Example +## Examples + +The following example returns the rows in the *StormEvents* table where the *State* column equals "kansas". This is a case-sensitive search. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -61,6 +63,8 @@ StormEvents |---| |0| +The following example returns the rows in the *StormEvents* table where the *State* column equals "KANSAS". This is a case-sensitive search. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query diff --git a/data-explorer/kusto/query/equals-operator.md b/data-explorer/kusto/query/equals-operator.md index beecddc397..8769e0c0ac 100644 --- a/data-explorer/kusto/query/equals-operator.md +++ b/data-explorer/kusto/query/equals-operator.md @@ -44,12 +44,11 @@ When possible, use [==](equals-cs-operator.md) - a case-sensitive version of the ## Returns -Rows in *T* for which the predicate is `true`. +Returns the rows in *T* for which the predicate is `true`. -## Example +## Examples -The `State` values in the `StormEvents` table are capitalized. The following query matches -columns with the value "KANSAS". +The following example shows how to use the `=~` operator to filter a record set for data with a case-insensitive string. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/erf-function.md b/data-explorer/kusto/query/erf-function.md index bbdad47237..a0cf557780 100644 --- a/data-explorer/kusto/query/erf-function.md +++ b/data-explorer/kusto/query/erf-function.md @@ -25,9 +25,11 @@ Returns the [error function](https://en.wikipedia.org/wiki/Error_function) of th ## Returns -Error function of x. +Returns the error function of x. -## Example +## Examples + +The following example shows how to use the `erf()` function to calculate the error function for a range of values from -3 to 3. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/erfc-function.md b/data-explorer/kusto/query/erfc-function.md index 911e6ce365..1a7d4b58b7 100644 --- a/data-explorer/kusto/query/erfc-function.md +++ b/data-explorer/kusto/query/erfc-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Returns the [complementary error function](https://en.wikipedia.org/wiki/Error_function) of the input. +Provides the [complementary error function](https://en.wikipedia.org/wiki/Error_function) of the input. ## Syntax @@ -25,9 +25,11 @@ Returns the [complementary error function](https://en.wikipedia.org/wiki/Error_f ## Returns -Complementary error function of x. +Returns the complementary error function of x. -## Example +## Examples + +The following example shows how to use the `erfc()` function to calculate the complementary error function for a range of values from -3 to 3. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/estimate-data-size-function.md b/data-explorer/kusto/query/estimate-data-size-function.md index cd9aa7db88..d5de9b9bc1 100644 --- a/data-explorer/kusto/query/estimate-data-size-function.md +++ b/data-explorer/kusto/query/estimate-data-size-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Returns an estimated data size in bytes of the selected columns of the tabular expression. +Provides an estimated data size in bytes for the selected columns of a tabular expression. ## Syntax @@ -25,11 +25,11 @@ Returns an estimated data size in bytes of the selected columns of the tabular e ## Returns -The estimated data size in bytes of the referenced columns. Estimation is based on data types and actual values. +Returns the estimated data size in bytes of the referenced columns. Estimation is based on data types and actual values. For example, the data size for the string `'{"a":"bcd"}'` is smaller than the dynamic value `dynamic({"a":"bcd"})` because the latter's internal representation is more complex than that of a string. -## Example +## Examples The following example calculates the total data size using `estimate_data_size()`. diff --git a/data-explorer/kusto/query/exp-function.md b/data-explorer/kusto/query/exp-function.md index 842dd60e50..a14b2fd7f1 100644 --- a/data-explorer/kusto/query/exp-function.md +++ b/data-explorer/kusto/query/exp-function.md @@ -27,6 +27,20 @@ The base-e exponential function of x, which is e raised to the power x: e^x. The exponential value of x. +## Examples + +The following example shows how to use the `exp()` function to calculate the exponential value of 2. + +```kusto +print result = exp(2) +``` + +**Output** + +| result | +|----------| +| 7.389056 | + ## Related content * For natural (base-e) logarithms, see [log()](log-function.md). diff --git a/data-explorer/kusto/query/exp10-function.md b/data-explorer/kusto/query/exp10-function.md index 139e482cac..5bcbf3a997 100644 --- a/data-explorer/kusto/query/exp10-function.md +++ b/data-explorer/kusto/query/exp10-function.md @@ -25,7 +25,23 @@ The base-10 exponential function of x, which is 10 raised to the power x: 10^x. ## Returns -The exponential value of x. +Returns the exponential value of x. + +## Examples + +The following example shows how to use the `exp10()` function to calculate the exponential value of 2. + +```kusto +print result = exp10(2) +``` + +**Output** + +```Kusto +result +------- +100 +``` ## Related content diff --git a/data-explorer/kusto/query/exp2-function.md b/data-explorer/kusto/query/exp2-function.md index a3c3fa7a70..0480347002 100644 --- a/data-explorer/kusto/query/exp2-function.md +++ b/data-explorer/kusto/query/exp2-function.md @@ -25,7 +25,24 @@ The base-2 exponential function of x, which is 2 raised to the power x: 2^x. ## Returns -The exponential value of x. +Returns the exponential value of x. + + +## Examples + +The following example shows how to use the `exp2()` function to calculate the exponential value of 3. + +```kusto +print result = exp2(3) +``` + +**Output:** + +```Kusto +result +-------- +8 +``` ## Related content diff --git a/data-explorer/kusto/query/extend-operator.md b/data-explorer/kusto/query/extend-operator.md index e04c879674..d831a59ede 100644 --- a/data-explorer/kusto/query/extend-operator.md +++ b/data-explorer/kusto/query/extend-operator.md @@ -32,7 +32,7 @@ Creates calculated columns and append them to the result set. ## Returns -A copy of the input tabular result set, such that: +Returns a copy of the input tabular result set, such that: 1. Column names noted by `extend` that already exist in the input are removed and appended as their new calculated values. @@ -48,7 +48,9 @@ A copy of the input tabular result set, such that: not done. In such cases, if the goal is to rename a column, use the [`project-rename` operator](project-rename-operator.md) instead. ::: moniker-end -## Example +## Examples + +The following example shows how to use the `extend` operator to create a new column called `Duration` that calculates the difference between the `EndTime` and `StartTime` columns in the `StormEvents` table. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/extent-id-function.md b/data-explorer/kusto/query/extent-id-function.md index ee588936bb..091ffd4d84 100644 --- a/data-explorer/kusto/query/extent-id-function.md +++ b/data-explorer/kusto/query/extent-id-function.md @@ -10,7 +10,7 @@ monikerRange: "microsoft-fabric || azure-data-explorer" > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Returns a unique identifier that identifies the data shard ("extent") that the current record resides in at the time the query was run. +Provides a unique identifier for the data shard ("extent") containing the current record at the time the query was run. Applying this function to calculated data that isn't attached to a data shard returns an empty guid (all zeros). @@ -29,10 +29,10 @@ Applying this function to calculated data that isn't attached to a data shard re ## Returns -A value of type `guid` that identifies the current record's data shard at the time the query was run, +Returns a value of type `guid` that identifies the current record's data shard at the time the query was run, or an empty guid (all zeros). -## Example +## Examples The following example shows how to get a list of all the data shards that currently have records from an hour ago with a specific value for the diff --git a/data-explorer/kusto/query/extent-tags-function.md b/data-explorer/kusto/query/extent-tags-function.md index 96bcf8b658..6f507b4513 100644 --- a/data-explorer/kusto/query/extent-tags-function.md +++ b/data-explorer/kusto/query/extent-tags-function.md @@ -10,7 +10,7 @@ monikerRange: "microsoft-fabric || azure-data-explorer" > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Returns a dynamic array with the [extent tags](../management/extent-tags.md) of the [extent](../management/extents-overview.md) that the current record is in. +Provides a dynamic array with the [extent tags](../management/extent-tags.md) of the [extent](../management/extents-overview.md) that the current record is in. If you apply this function to calculated data, which isn't attached to a data shard, returns an empty value. @@ -22,7 +22,7 @@ If you apply this function to calculated data, which isn't attached to a data sh ## Returns -A value of type `dynamic` that is an array holding the current record's extent tags, +Returns a value of type `dynamic` that is an array holding the current record's extent tags, or an empty value. ## Examples diff --git a/data-explorer/kusto/query/externaldata-operator.md b/data-explorer/kusto/query/externaldata-operator.md index 6e343565c8..abbd7b33de 100644 --- a/data-explorer/kusto/query/externaldata-operator.md +++ b/data-explorer/kusto/query/externaldata-operator.md @@ -61,11 +61,7 @@ The `externaldata` operator returns a data table of the given schema whose data ## Examples -The examples query data in an external storage file. - -### Fetch a list of user IDs stored in Azure Blob Storage - -The following example shows how to find all records in a table whose `UserID` column falls into a known set of IDs, held (one per line) in an external storage file. Since the data format isn't specified, the detected data format is `TXT`. +The following example shows how to find all records in a table whose `UserID` column falls into a known set of IDs, held (one per line) in an external storage file stored in Azure Blob Storage. Since the data format isn't specified, the detected data format is `TXT`. ```kusto Users @@ -76,8 +72,6 @@ Users | ... ``` -### Query multiple data files - The following example queries multiple data files stored in external storage. ```kusto @@ -96,7 +90,6 @@ The above example can be thought of as a quick way to query multiple data files > [!NOTE] > Data partitioning isn't recognized by the `externaldata` operator. -### Query hierarchical data formats To query hierarchical data format, such as `JSON`, `Parquet`, `Avro`, or `ORC`, `ingestionMapping` must be specified in the operator properties. In this example, there's a JSON file stored in Azure Blob Storage with the following contents: diff --git a/data-explorer/kusto/query/extract-all-function.md b/data-explorer/kusto/query/extract-all-function.md index 3d8d781697..6af8e74275 100644 --- a/data-explorer/kusto/query/extract-all-function.md +++ b/data-explorer/kusto/query/extract-all-function.md @@ -41,9 +41,7 @@ print extract_all(@"(\d+)", "a set of numbers: 123, 567 and 789") // results wit ## Examples -### Extract a single capture group - -The following query returns hex-byte representation (two hex-digits) of the GUID. +The following example extracts a single group capture, returning a hex-byte representation (two hex-digits) of the GUID. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -61,9 +59,7 @@ print Id="82b8be2d-dfa7-4bd1-8f63-24ad26d31449" |---|---| |82b8be2d-dfa7-4bd1-8f63-24ad26d31449|["82","b8","be","2d","df","a7","4b","d1","8f","63","24","ad","26","d3","14","49"]| -### Extract several capture groups - -The following query uses a regular expression with three capturing groups to split each GUID part into first letter, last letter, and whatever is in the middle. +The following example uses a regular expression with three capturing groups to split each GUID part into first letter, last letter, and whatever is in the middle. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -81,9 +77,7 @@ print Id="82b8be2d-dfa7-4bd1-8f63-24ad26d31449" |---|---| |82b8be2d-dfa7-4bd1-8f63-24ad26d31449|[["8","2b8be2","d"],["d","fa","7"],["4","bd","1"],["8","f6","3"],["2","4ad26d3144","9"]]| -### Extract a subset of capture groups - -The following query selects a subset of capturing groups. +The following example selects a subset of capturing groups. The regular expression matches the first letter, last letter, and all the rest. @@ -105,9 +99,7 @@ print Id="82b8be2d-dfa7-4bd1-8f63-24ad26d31449" |---|---| |82b8be2d-dfa7-4bd1-8f63-24ad26d31449|[["8","d"],["d","7"],["4","1"],["8","3"],["2","9"]]| -### Using named capture groups - -The *captureGroups* in the following query uses both capture group indexes and named capture group references to fetch matching values. +The following example shows how *captureGroups* uses both capture group indexes and named capture group references to fetch matching values. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/extract-function.md b/data-explorer/kusto/query/extract-function.md index f0805eb3c0..c922c2c328 100644 --- a/data-explorer/kusto/query/extract-function.md +++ b/data-explorer/kusto/query/extract-function.md @@ -36,9 +36,7 @@ If there's no match, or the type conversion fails: `null`. ## Examples -### Extract month from datetime string - -The following query extracts the month from the string `Dates` and returns a table with the date string and the month. +The following example extracts the month from the string `Dates` and returns a table with the date string and the month. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -65,8 +63,6 @@ Dates | 21-07-2023 | 7 | | 10-03-2022 | 3 | -### Extract username from a string - The following example returns the username from the string. The regular expression `([^,]+)` matches the text following "User: " up to the next comma, effectively extracting the username. :::moniker range="azure-data-explorer" diff --git a/data-explorer/kusto/query/extract-json-function.md b/data-explorer/kusto/query/extract-json-function.md index c77c7fceab..90e540debe 100644 --- a/data-explorer/kusto/query/extract-json-function.md +++ b/data-explorer/kusto/query/extract-json-function.md @@ -40,7 +40,9 @@ Optionally convert the extracted string to a specific type. This function performs a [JSONPath](jsonpath.md) query into dataSource, which contains a valid JSON string, optionally converting that value to another type depending on the third argument. -## Example +## Examples + +The following example extracts the name from a JSON string and returns a table with the name. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/facet-operator.md b/data-explorer/kusto/query/facet-operator.md index e8e417d77b..2157edde82 100644 --- a/data-explorer/kusto/query/facet-operator.md +++ b/data-explorer/kusto/query/facet-operator.md @@ -30,7 +30,9 @@ An additional table can be created by using the `with` clause. Facet result tabl Multiple tables: one for the `with` clause, and one for each column. -## Example +## Examples + +The following example shows how to use the `facet` operator to return a table for each specified column. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/find-operator.md b/data-explorer/kusto/query/find-operator.md index e560605190..b42c97108c 100644 --- a/data-explorer/kusto/query/find-operator.md +++ b/data-explorer/kusto/query/find-operator.md @@ -124,13 +124,11 @@ For example, see [examples of cases where `find` acts as a union](find-operator. ## Examples -[!INCLUDE [help-cluster](../includes/help-cluster-note.md)] +### General examples ::: moniker range="microsoft-fabric || azure-data-explorer" -### Term lookup across all tables - -The query finds all rows from all tables in the current database in which any column includes the word `Hernandez`. The resulting records are transformed according to the [output schema](#output-schema). The output includes rows from the `Customers` table and the `SalesTable` table of the `ContosoSales` database. +The following example finds all rows from all tables in the current database in which any column includes the word `Hernandez`. The resulting records are transformed according to the [output schema](#output-schema). The output includes rows from the `Customers` table and the `SalesTable` table of the `ContosoSales` database. > [!div class="nextstepaction"] > Run the query @@ -150,9 +148,7 @@ This table shows the first three rows of the output. | Customers |{"CityName":"Ballard","CompanyName":"NULL","ContinentName":"North America","CustomerKey":7888,"Education":"Partial High School","FirstName":"Kari","Gender":"F","LastName":"Hernandez","MaritalStatus":"S","Occupation":"Clerical","RegionCountryName":"United States","StateProvinceName":"Washington"} | |...|...| -### Term lookup across all tables matching a name pattern - -The query finds all rows from all tables in the current database whose name starts with `C`, and in which any column includes the word `Hernandez`. The resulting records are transformed according to the [output schema](#output-schema). Now, the output only contains records from the `Customers` table. +The following example finds all rows from all tables in the current database whose name starts with `C`, and in which any column includes the word `Hernandez`. The resulting records are transformed according to the [output schema](#output-schema). Now, the output only contains records from the `Customers` table. > [!div class="nextstepaction"] > Run the query @@ -172,9 +168,8 @@ This table shows the first three rows of the output. | ConferenceSessions | {"conference":"Build 2021","sessionid":"CON-PRT103","session_title":"Roundtable: Advanced Kusto query language topics","session_type":"Roundtable","owner":"Avner Aharoni","participants":"Alexander Sloutsky, Tzvia Gitlin-Troyna","URL":"https://sessions.mybuild.microsoft.com/sessions/details/4d4887e9-f08d-4f88-99ac-41e5feb869e7","level":200,"session_location":"Online","starttime":"2021-05-26T08:30:00.0000000Z","duration":60,"time_and_duration":"Wednesday, May 26\n8:30 AM - 9:30 AM GMT","kusto_affinity":"Focused"} | |...|...| -### Term lookup across the cluster -The query finds all rows from all tables in all databases in the cluster in which any column includes the word `Kusto`. +The following example finds all rows from all tables in all databases in the cluster in which any column includes the word `Kusto`. This query is a [cross-database](cross-cluster-or-database-queries.md) query. The resulting records are transformed according to the [output schema](#output-schema). @@ -196,15 +191,12 @@ This table shows the first three rows of the output. | database("Samples").ConferenceSessions | {"conference":"Build 2021","sessionid":"CON-PRT103","session_title":"Roundtable: Advanced Kusto query language topics","session_type":"Roundtable","owner":"Avner Aharoni","participants":"Alexander Sloutsky, Tzvia Gitlin-Troyna","URL":"https://sessions.mybuild.microsoft.com/sessions/details/4d4887e9-f08d-4f88-99ac-41e5feb869e7","level":200,"session_location":"Online","starttime":"2021-05-26T08:30:00.0000000Z","duration":60,"time_and_duration":"Wednesday, May 26\n8:30 AM - 9:30 AM GMT","kusto_affinity":"Focused"} |...|...| -### Term lookup matching a name pattern in the cluster - -The query finds all rows from all tables whose name starts with `K` in all databases whose name start with `B` and in which any column includes the word `Kusto`. +The following example finds all rows from all tables whose name starts with `K` in all databases whose name start with `B` and in which any column includes the word `Kusto`. The resulting records are transformed according to the [output schema](#output-schema). > [!div class="nextstepaction"] > Run the query - ```kusto find in (database("S*").C*) where * has "Kusto" ``` @@ -220,9 +212,7 @@ This table shows the first three rows of the output. | ConferenceSessions | {"conference":"Build 2021","sessionid":"CON-PRT103","session_title":"Roundtable: Advanced Kusto query language topics","session_type":"Roundtable","owner":"Avner Aharoni","participants":"Alexander Sloutsky, Tzvia Gitlin-Troyna","URL":"https://sessions.mybuild.microsoft.com/sessions/details/4d4887e9-f08d-4f88-99ac-41e5feb869e7","level":200,"session_location":"Online","starttime":"2021-05-26T08:30:00.0000000Z","duration":60,"time_and_duration":"Wednesday, May 26\n8:30 AM - 9:30 AM GMT","kusto_affinity":"Focused"} | |...|...| -### Term lookup in several clusters - -The query finds all rows from all tables whose name starts with `K` in all databases whose name start with `B` and in which any column includes the word `Kusto`. +The following example finds all rows from all tables whose name starts with `K` in all databases whose name start with `B` and in which any column includes the word `Kusto`. The resulting records are transformed according to the [output schema](#output-schema). ```kusto @@ -234,9 +224,8 @@ where * has "Kusto" ::: moniker range="azure-monitor || microsoft-sentinel" -### Term lookup across all tables -The query finds all rows from all tables in which any column includes the word `Kusto`. +The following example finds all rows from all tables in which any column includes the word `Kusto`. The resulting records are transformed according to the [output schema](#output-schema). ```kusto @@ -245,12 +234,11 @@ find "Kusto" ::: moniker-end -## Examples of `find` output results +### Examples of `find` output results -The following examples show how `find` can be used over two tables: *EventsTable1* and *EventsTable2*. Assume we have the next content of these two tables: -### EventsTable1 +EventsTable1 |Session_Id|Level|EventText|Version |---|---|---|---| @@ -259,7 +247,7 @@ Assume we have the next content of these two tables: |28b8e46e-3c31-43cf-83cb-48921c3986fc|Error|Some Text3|v1.0.1 |8f057b11-3281-45c3-a856-05ebb18a3c59|Information|Some Text4|v1.1.0 -### EventsTable2 +EventsTable2 |Session_Id|Level|EventText|EventName |---|---|---|---| @@ -268,9 +256,7 @@ Assume we have the next content of these two tables: |acbd207d-51aa-4df7-bfa7-be70eb68f04e|Error|Some Other Text3|Event3 |15eaeab5-8576-4b58-8fc6-478f75d8fee4|Error|Some Other Text4|Event4 -### Search in common columns, project common, and uncommon columns, and pack the rest - -The query searches for specific records in *EventsTable1* and *EventsTable2* based on a given *Session_Id* and an *Error* Level. It then projects three specific columns: *EventText*, *Version*, and *EventName*, and packs all other remaining columns into a dynamic object. +The following example searches for specific records in *EventsTable1* and *EventsTable2* based on a given *Session_Id* and an *Error* Level. It then projects three specific columns: *EventText*, *Version*, and *EventName*, and packs all other remaining columns into a dynamic object. ```kusto find in (EventsTable1, EventsTable2) @@ -285,9 +271,8 @@ find in (EventsTable1, EventsTable2) |EventsTable1|Some Text2|v1.0.0||{"Session_Id":"acbd207d-51aa-4df7-bfa7-be70eb68f04e", "Level":"Error"} |EventsTable2|Some Other Text3||Event3|{"Session_Id":"acbd207d-51aa-4df7-bfa7-be70eb68f04e", "Level":"Error"} -### Search in common and uncommon columns -The query searches for records that either have *Version* as 'v1.0.0' or *EventName* as 'Event1', and then it projects (selects) four specific columns: *Session_Id*, *EventText*, *Version*, and *EventName* from those filtered results. +The following example searches for records that either have *Version* as 'v1.0.0' or *EventName* as 'Event1', and then it projects (selects) four specific columns: *Session_Id*, *EventText*, *Version*, and *EventName* from those filtered results. ```kusto find Version == 'v1.0.0' or EventName == 'Event1' project Session_Id, EventText, Version, EventName @@ -304,9 +289,7 @@ find Version == 'v1.0.0' or EventName == 'Event1' project Session_Id, EventText, > [!NOTE] > In practice, *EventsTable1* rows are filtered with ```Version == 'v1.0.0'``` predicate and *EventsTable2* rows are filtered with ```EventName == 'Event1'``` predicate. -### Use abbreviated notation to search across all tables in the current database - -This query searches the database for any records with a *Session_Id* that matches 'acbd207d-51aa-4df7-bfa7-be70eb68f04e'. It retrieves records from all tables and columns that contain this specific *Session_Id*. +The following example searches the database for any records with a *Session_Id* that matches 'acbd207d-51aa-4df7-bfa7-be70eb68f04e'. It retrieves records from all tables and columns that contain this specific *Session_Id*. ```kusto find Session_Id == 'acbd207d-51aa-4df7-bfa7-be70eb68f04e' @@ -321,9 +304,7 @@ find Session_Id == 'acbd207d-51aa-4df7-bfa7-be70eb68f04e' |EventsTable2|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Information|Some Other Text2|{"EventName":"Event2"}| |EventsTable2|acbd207d-51aa-4df7-bfa7-be70eb68f04e|Error|Some Other Text3|{"EventName":"Event3"}| -### Return the results from each row as a property bag - -This query searches the database for records with the specified *Session_Id* and returns all columns of those records as a single dynamic object. +The following example searches the database for records with the specified *Session_Id* and returns all columns of those records as a single dynamic object. ```kusto find Session_Id == 'acbd207d-51aa-4df7-bfa7-be70eb68f04e' project pack_all() @@ -338,13 +319,11 @@ find Session_Id == 'acbd207d-51aa-4df7-bfa7-be70eb68f04e' project pack_all() |EventsTable2|{"Session_Id":"acbd207d-51aa-4df7-bfa7-be70eb68f04e", "Level":"Information", "EventText":"Some Other Text2", "EventName":"Event2"}| |EventsTable2|{"Session_Id":"acbd207d-51aa-4df7-bfa7-be70eb68f04e", "Level":"Error", "EventText":"Some Other Text3", "EventName":"Event3"}| -## Examples of cases where `find` acts as `union` +### Examples of cases where `find` acts as union The `find` operator in Kusto can sometimes act like a `union` operator, mainly when it's used to search across multiple tables. -### Using a nontabular expression as find operand - -The query first creates a view that filters *EventsTable1* to only include error-level records. Then, it searches within this filtered view and the EventsTable2 table for records with a specific *Session_Id*. +The following example first creates a view that filters *EventsTable1* to only include error-level records. Then, it searches within this filtered view and the EventsTable2 table for records with a specific *Session_Id*. ```kusto let PartialEventsTable1 = view() { EventsTable1 | where Level == 'Error' }; @@ -352,8 +331,7 @@ find in (PartialEventsTable1, EventsTable2) where Session_Id == 'acbd207d-51aa-4df7-bfa7-be70eb68f04e' ``` -### Referencing a column that appears in multiple tables and has multiple types - +The following examples demonstrate how the `find` operator can act as a `union` when a column appears in multiple tables with different types. In this case, the `ProcessId` column is present in both *Table1* and *Table2*, but with different types. For this example, create two tables by running: ```kusto diff --git a/data-explorer/kusto/query/fork-operator.md b/data-explorer/kusto/query/fork-operator.md index 1a21bc307f..99ccb1140c 100644 --- a/data-explorer/kusto/query/fork-operator.md +++ b/data-explorer/kusto/query/fork-operator.md @@ -64,9 +64,7 @@ Multiple result tables, one for each of the *subquery* arguments. [!INCLUDE [help-cluster-note](../includes/help-cluster-note.md)] -The examples output multiple tables, with named and umnamed columns. - -### Unnamed subqueries +The following example returns two tables with unnamed columns. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/format-bytes-function.md b/data-explorer/kusto/query/format-bytes-function.md index d873e14448..5a1d785940 100644 --- a/data-explorer/kusto/query/format-bytes-function.md +++ b/data-explorer/kusto/query/format-bytes-function.md @@ -31,6 +31,9 @@ A string of *size* formatted as data size in bytes. ## Examples +The following example shows how to use the `format_bytes()` function to format a number as a string representing data size in bytes. + +```kusto :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query diff --git a/data-explorer/kusto/query/format-datetime-function.md b/data-explorer/kusto/query/format-datetime-function.md index 368ade3faa..7ff38a1cca 100644 --- a/data-explorer/kusto/query/format-datetime-function.md +++ b/data-explorer/kusto/query/format-datetime-function.md @@ -83,8 +83,9 @@ A string with *date* formatted as specified by *format*. ## Examples -The following three examples return differently formatted datetimes. +The following example shows how to use the `format_datetime()` function to format a datetime value. The output is formatted with two digits for the day, hour, minute, and second. +```kusto :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -102,6 +103,9 @@ v1=format_datetime(dt,'yy-MM-dd [HH:mm:ss]') |--| |17-01-29 [09:00:05]| +The following example shows how to use the `format_datetime()` function to format a datetime value. The output is formatted with a single digit for the month and hour, and with four digits for the year. + +```kusto :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -119,6 +123,9 @@ v2=format_datetime(dt, 'yyyy-M-dd [H:mm:ss]') |--| |2017-1-29 [9:00:05]| +The following example shows how to use the `format_datetime()` function to format a datetime value. The output is formatted with a single digit for the month and hour, and with four digits for the year. + +```kusto :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query diff --git a/data-explorer/kusto/query/format-ipv4-function.md b/data-explorer/kusto/query/format-ipv4-function.md index dc589c6e5e..57cd5126f3 100644 --- a/data-explorer/kusto/query/format-ipv4-function.md +++ b/data-explorer/kusto/query/format-ipv4-function.md @@ -31,6 +31,9 @@ If conversion isn't successful, the result will be an empty string. ## Examples +The following example shows how to use the `format_ipv4()` function to parse the input with a netmask and return a string representing the IPv4 address. + +```kusto :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query diff --git a/data-explorer/kusto/query/geo-h3cell-parent-function.md b/data-explorer/kusto/query/geo-h3cell-parent-function.md index d1d4d93c99..a9ec493a79 100644 --- a/data-explorer/kusto/query/geo-h3cell-parent-function.md +++ b/data-explorer/kusto/query/geo-h3cell-parent-function.md @@ -32,6 +32,8 @@ H3 Cell parent token `string`. If the H3 Cell is invalid or parent resolution is ## Examples +The following example calculates H3 cell parent. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -64,6 +66,8 @@ print parent_cell = geo_h3cell_parent('862a1072fffffff', 1) |---| |812a3ffffffffff| +The following example calculates an array of input H3 cell with its parent. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -79,6 +83,8 @@ print parent_res = geo_h3cell_level(geo_h3cell_parent((geo_point_to_h3cell(1,1,1 |---| |9| +The following example calculates H3 cell level. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query diff --git a/data-explorer/kusto/query/geo-h3cell-to-central-point-function.md b/data-explorer/kusto/query/geo-h3cell-to-central-point-function.md index 8e9e26d718..08da47bb04 100644 --- a/data-explorer/kusto/query/geo-h3cell-to-central-point-function.md +++ b/data-explorer/kusto/query/geo-h3cell-to-central-point-function.md @@ -34,6 +34,8 @@ The geospatial coordinate values in [GeoJSON Format](https://tools.ietf.org/html ## Examples +The following example produces the geospatial coordinates that represent the center of an H3 cell. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query diff --git a/data-explorer/kusto/query/geo-h3cell-to-polygon-function.md b/data-explorer/kusto/query/geo-h3cell-to-polygon-function.md index 588dcdf447..90c09b8822 100644 --- a/data-explorer/kusto/query/geo-h3cell-to-polygon-function.md +++ b/data-explorer/kusto/query/geo-h3cell-to-polygon-function.md @@ -34,6 +34,8 @@ Polygon in [GeoJSON Format](https://tools.ietf.org/html/rfc7946) and of a [dynam ## Examples +The following example produces the polygon that represents the H3 Cell rectangular area. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query diff --git a/data-explorer/kusto/query/geo-info-from-ip-address-function.md b/data-explorer/kusto/query/geo-info-from-ip-address-function.md index fcb0985069..d96313a6b4 100644 --- a/data-explorer/kusto/query/geo-info-from-ip-address-function.md +++ b/data-explorer/kusto/query/geo-info-from-ip-address-function.md @@ -45,6 +45,8 @@ A dynamic object containing the information on IP address whereabouts (if the in ## Examples +The following example retrieves geolocation information about the specified IPv4 address. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -60,6 +62,7 @@ print ip_location=geo_info_from_ip_address('20.53.203.50') |--| |`{"country": "Australia", "state": "New South Wales", "city": "Sydney", "latitude": -33.8715, "longitude": 151.2006}`| +The following example retrieves geolocation information about the specified IPv6 address. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/geo-line-buffer-function.md b/data-explorer/kusto/query/geo-line-buffer-function.md index b0fff04ea3..8b2c9977d6 100644 --- a/data-explorer/kusto/query/geo-line-buffer-function.md +++ b/data-explorer/kusto/query/geo-line-buffer-function.md @@ -49,7 +49,7 @@ dynamic({"type": "MultiLineString","coordinates": [[line_1, line_2, ..., line_N] ## Examples -The following query calculates polygon around line, with radius of 4 meters and 0.1 meter tolerance +The following example calculates polygon around line, with radius of 4 meters and 0.1 meter tolerance ```kusto let line = dynamic({"type":"LineString","coordinates":[[-80.66634997047466,24.894526340592122],[-80.67373241820246,24.890808090321286]]}); diff --git a/data-explorer/kusto/query/geo-line-to-s2cells-function.md b/data-explorer/kusto/query/geo-line-to-s2cells-function.md index 71908f28df..7131ae9cb3 100644 --- a/data-explorer/kusto/query/geo-line-to-s2cells-function.md +++ b/data-explorer/kusto/query/geo-line-to-s2cells-function.md @@ -58,7 +58,7 @@ If any of the following: line, level, radius is invalid, or the cell count exce ## Examples -The following query finds all tube stations within 500 meters of streets and aggregates tubes count by street name. +The following example finds all tube stations within 500 meters of streets and aggregates tubes count by street name. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/geo-point-buffer-function.md b/data-explorer/kusto/query/geo-point-buffer-function.md index 3980bac367..e94e51e357 100644 --- a/data-explorer/kusto/query/geo-point-buffer-function.md +++ b/data-explorer/kusto/query/geo-point-buffer-function.md @@ -37,7 +37,7 @@ Polygon around the input point. If the coordinates or radius or tolerance is inv ## Examples -The following query calculates polygon around [-115.1745008278, 36.1497251277] coordinates, with 20km radius. +The following example calculates polygon around [-115.1745008278, 36.1497251277] coordinates, with 20km radius. ```kusto print buffer = geo_point_buffer(-115.1745008278, 36.1497251277, 20000) diff --git a/data-explorer/kusto/query/geo-point-to-h3cell-function.md b/data-explorer/kusto/query/geo-point-to-h3cell-function.md index c761620565..f3db70988b 100644 --- a/data-explorer/kusto/query/geo-point-to-h3cell-function.md +++ b/data-explorer/kusto/query/geo-point-to-h3cell-function.md @@ -73,6 +73,8 @@ For comparison with other available grid systems. see [geospatial clustering wit ## Examples +The following example calculates the H3 Cell token string value of a geographic location. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query diff --git a/data-explorer/kusto/query/geo-point-to-s2cell-function.md b/data-explorer/kusto/query/geo-point-to-s2cell-function.md index 560a324449..8d7ca2a181 100644 --- a/data-explorer/kusto/query/geo-point-to-s2cell-function.md +++ b/data-explorer/kusto/query/geo-point-to-s2cell-function.md @@ -81,8 +81,6 @@ For comparison with other available grid systems, see [geospatial clustering wit ## Examples -### US storm events aggregated by S2 cell - The following example finds US storm events aggregated by S2 cells. :::moniker range="azure-data-explorer" @@ -119,7 +117,6 @@ print s2cell = geo_point_to_s2cell(-80.195829, 25.802215, 8) |--------| | 88d9b | -### Find a group of coordinates The following example finds groups of coordinates. Every pair of coordinates in the group resides in the S2 cell with a maximum area of 1632.45 km². @@ -147,8 +144,6 @@ datatable(location_id:string, longitude:real, latitude:real) | 47b1d | 2 | ["A","B"] | | 47ae3 | 1 | ["C"] | -### Empty results - The following example produces an empty result because of the invalid coordinate input. :::moniker range="azure-data-explorer" diff --git a/data-explorer/kusto/query/geo-polygon-buffer-function.md b/data-explorer/kusto/query/geo-polygon-buffer-function.md index 95ec74c4d0..f67b8ec3ac 100644 --- a/data-explorer/kusto/query/geo-polygon-buffer-function.md +++ b/data-explorer/kusto/query/geo-polygon-buffer-function.md @@ -52,7 +52,7 @@ dynamic({"type": "MultiPolygon","coordinates": [[LinearRingShell, LinearRingHole ## Examples -The following query calculates polygon around input polygon, with radius of 10km. +The following example calculates polygon around input polygon, with radius of 10km. ```kusto let polygon = dynamic({"type":"Polygon","coordinates":[[[139.813757,35.719666],[139.72558,35.71813],[139.727471,35.653231],[139.818721,35.657264],[139.813757,35.719666]]]}); @@ -80,7 +80,6 @@ datatable(polygon:dynamic, radius:real ) |---| |{"type": "Polygon","coordinates": [ ... ]}| - The following example will return true, due to invalid polygon. ```kusto @@ -100,4 +99,3 @@ print buffer = isnull(geo_polygon_buffer(dynamic({"type":"Polygon","coordinates" |buffer| |---| |True| - diff --git a/data-explorer/kusto/query/gzip-base64-decompress.md b/data-explorer/kusto/query/gzip-base64-decompress.md index 09961497e2..085b022b41 100644 --- a/data-explorer/kusto/query/gzip-base64-decompress.md +++ b/data-explorer/kusto/query/gzip-base64-decompress.md @@ -37,7 +37,7 @@ Decodes the input string from base64 and performs gzip decompression. ## Examples -### Valid input +The following example shows how to decode a base64 string and decompress it using gzip and valid input. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -52,7 +52,7 @@ print res=gzip_decompress_from_base64_string("H4sIAAAAAAAA/wEUAOv/MTIzNDU2Nzg5MH |--| |"1234567890qwertyuiop"| -### Invalid input +The following example shows how to decode a base64 string and decompress it using gzip and invalid input. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/has-all-operator.md b/data-explorer/kusto/query/has-all-operator.md index 8a03387d69..d059a07ca0 100644 --- a/data-explorer/kusto/query/has-all-operator.md +++ b/data-explorer/kusto/query/has-all-operator.md @@ -33,8 +33,6 @@ Rows in *T* for which the predicate is `true`. ## Examples -### Set of scalars - The following query shows how to use `has_all` with a comma-separated set of scalar values. :::moniker range="azure-data-explorer" @@ -57,8 +55,6 @@ StormEvents |Hail|392| |Flash Flood|24| -### Dynamic array - The same result can be achieved using a dynamic array notation. :::moniker range="azure-data-explorer" diff --git a/data-explorer/kusto/query/has-any-index-function.md b/data-explorer/kusto/query/has-any-index-function.md index 3bdba80976..7fc596feb9 100644 --- a/data-explorer/kusto/query/has-any-index-function.md +++ b/data-explorer/kusto/query/has-any-index-function.md @@ -29,7 +29,9 @@ Searches the string for items specified in the array and returns the position in Zero-based index position of the first item in *values* that is found in *source*. Returns -1 if none of the array items were found in the string or if *values* is empty. -## Example +## Examples + +The following example shows how to use `has_any_index` with a comma-separated set of scalar values. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/has-any-ipv4-function.md b/data-explorer/kusto/query/has-any-ipv4-function.md index 7388f78656..fb34cfd6ad 100644 --- a/data-explorer/kusto/query/has-any-ipv4-function.md +++ b/data-explorer/kusto/query/has-any-ipv4-function.md @@ -39,7 +39,7 @@ IP address entrances in a text must be properly delimited with non-alphanumeric ## Examples -### IP addresses as list of strings +The following example demonstrates using `has_any_ipv4` with multiple scalar values, where each IP address is provided as a separate string argument. The IP addresses in the text are properly delimited by non-alphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -54,7 +54,7 @@ print result=has_any_ipv4('05:04:54 127.0.0.1 GET /favicon.ico 404', '127.0.0.1' |--| |true| -### IP addresses as dynamic array +The following example demonstrates using `has_any_ipv4` with a dynamic array of IP addresses. The IP addresses in the text are properly delimited by non-alphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -69,7 +69,7 @@ print result=has_any_ipv4('05:04:54 127.0.0.1 GET /favicon.ico 404', dynamic(['1 |--| |true| -### Invalid IPv4 address +The following example demonstrates using `has_any_ipv4` with an invalid IPv4 address. The IP addresses in the text are properly delimited by non-alphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -84,7 +84,7 @@ print result=has_any_ipv4('05:04:54 127.0.0.256 GET /favicon.ico 404', dynamic([ |--| |false| -### Improperly deliminated IP address +The following example demonstrates using `has_any_ipv4` with an improperly delimited IP address. The IP addresses in the text are not properly delimited by non-alphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/has-any-ipv4-prefix-function.md b/data-explorer/kusto/query/has-any-ipv4-prefix-function.md index cec9760d88..07d597fec8 100644 --- a/data-explorer/kusto/query/has-any-ipv4-prefix-function.md +++ b/data-explorer/kusto/query/has-any-ipv4-prefix-function.md @@ -39,7 +39,7 @@ IP address entrances in a text must be properly delimited with non-alphanumeric ## Examples -### IP addresses as list of strings +The following example demonstrates using `has_any_ipv4_prefix` with multiple scalar values, where each IP address is provided as a separate string argument. The IP addresses in the text are properly delimited by non-alphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -55,7 +55,7 @@ print result=has_any_ipv4_prefix('05:04:54 127.0.0.1 GET /favicon.ico 404', '127 |--| |true| -### IP addresses as dynamic array +The following example demonstrates using `has_any_ipv4_prefix` with a dynamic array of IP addresses. The IP addresses in the text are properly delimited by non-alphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -70,7 +70,7 @@ print result=has_any_ipv4_prefix('05:04:54 127.0.0.1 GET /favicon.ico 404', dyna |--| |true| -### Invalid IPv4 prefix +The following example demonstrates using `has_any_ipv4_prefix` with an invalid IPv4 address. The IP addresses in the text are properly delimited by non-alphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -85,7 +85,7 @@ print result=has_any_ipv4_prefix('05:04:54 127.0.0.1 GET /favicon.ico 404', '127 |--| |false| -### Improperly deliminated IP address +The following example demonstrates using `has_any_ipv4_prefix` with an improperly delimited IP address. The IP addresses in the text are not properly delimited by non-alphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/has-any-operator.md b/data-explorer/kusto/query/has-any-operator.md index 3ecf3bf31b..5cdb143b80 100644 --- a/data-explorer/kusto/query/has-any-operator.md +++ b/data-explorer/kusto/query/has-any-operator.md @@ -32,7 +32,7 @@ For more information about other operators and to determine which operator is mo | *expression* | scalar or tabular | :heavy_check_mark: | An expression that specifies the values for which to search. Each expression can be a [scalar](scalar-data-types/index.md) value or a [tabular expression](tabular-expression-statements.md) that produces a set of values. If a tabular expression has multiple columns, the first column is used. The search will consider up to 10,000 distinct values.| > [!NOTE] -> An inline tabular expression must be enclosed with double parentheses. See [example](#tabular-expression). +> An inline tabular expression must be enclosed with double parentheses. ## Returns @@ -40,8 +40,6 @@ Rows in *T* for which the predicate is `true`. ## Examples -### List of scalars - The following query shows how to use `has_any` with a comma-separated list of scalar values. :::moniker range="azure-data-explorer" @@ -68,8 +66,6 @@ StormEvents |NEW MEXICO|527| |NEW HAMPSHIRE|394| -### Dynamic array - The following query shows how to use `has_any` with a dynamic array. :::moniker range="azure-data-explorer" @@ -119,8 +115,6 @@ StormEvents |ATLANTIC SOUTH|193| |ATLANTIC NORTH|188| -### Tabular expression - The following query shows how to use `has_any` with an inline tabular expression. Notice that an inline tabular expression must be enclosed with double parentheses. :::moniker range="azure-data-explorer" @@ -168,4 +162,4 @@ StormEvents |MISSOURI |2016| |GEORGIA |1983| |MINNESOTA |1881| -|...|...| \ No newline at end of file +|...|...| diff --git a/data-explorer/kusto/query/has-cs-operator.md b/data-explorer/kusto/query/has-cs-operator.md index e914c19af7..930734e664 100644 --- a/data-explorer/kusto/query/has-cs-operator.md +++ b/data-explorer/kusto/query/has-cs-operator.md @@ -35,7 +35,9 @@ Filters a record set for data with a case-sensitive search string. `has_cs` sear Rows in *T* for which the predicate is `true`. -## Example +## Examples + +The following example demonstrates using `has_cs` with a case-sensitive search string. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/has-ipv4-function.md b/data-explorer/kusto/query/has-ipv4-function.md index e75fdbb0c7..8c5aa5f2f4 100644 --- a/data-explorer/kusto/query/has-ipv4-function.md +++ b/data-explorer/kusto/query/has-ipv4-function.md @@ -40,7 +40,7 @@ IP address entrances in a text must be properly delimited with non-alphanumeric ## Examples -### Properly formatted IP address +The following example demonstrates using `has_ipv4` with multiple scalar values, where each IP address is provided as a separate string argument. The IP addresses in the text are properly delimited by non-alphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -57,7 +57,7 @@ print result=has_ipv4('05:04:54 127.0.0.1 GET /favicon.ico 404', '127.0.0.1') |--| |true| -### Invalid IP address +The following example demonstrates using `has_ipv4` with an invalid IP address. The IP address in the text is properly delimited by non-alphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -74,7 +74,7 @@ print result=has_ipv4('05:04:54 127.0.0.256 GET /favicon.ico 404', '127.0.0.256' |--| |false| -### Improperly delimited IP +The following example demonstrates using `has_ipv4` with an improperly delimited IP address. The IP address in the text is improperly delimited by non-alphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/has-ipv4-prefix-function.md b/data-explorer/kusto/query/has-ipv4-prefix-function.md index eb894a64e8..b9acaba70d 100644 --- a/data-explorer/kusto/query/has-ipv4-prefix-function.md +++ b/data-explorer/kusto/query/has-ipv4-prefix-function.md @@ -40,7 +40,7 @@ IP address entrances in a text must be properly delimited with nonalphanumeric c ## Examples -### Properly formatted IPv4 prefix +The following example shows how to use the `has_ipv4_prefix` function to search for a specific IPv4 address prefix within text. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -55,7 +55,7 @@ print result=has_ipv4_prefix('05:04:54 127.0.0.1 GET /favicon.ico 404', '127.0.' |--| |true| -### Invalid IPv4 prefix +The following example demonstrates using `has_ipv4_prefix` with an invalid IP address prefix. The IP address in the text is properly delimited by nonalphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -70,7 +70,7 @@ print result=has_ipv4_prefix('05:04:54 127.0.0.1 GET /favicon.ico 404', '127.0') |--| |false| -### Invalid IPv4 address +The following example demonstrates using `has_ipv4_prefix` with an invalid IP address. The IP address in the text is properly delimited by nonalphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -85,7 +85,7 @@ print result=has_ipv4_prefix('05:04:54 127.0.0.256 GET /favicon.ico 404', '127.0 |--| |false| -### Improperly delimited IPv4 address +The following example demonstrates using `has_ipv4_prefix` with an improperly delimited IP address. The IP address in the text is improperly delimited by nonalphanumeric characters. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/has-operator.md b/data-explorer/kusto/query/has-operator.md index e4c423ad33..3e4b66f529 100644 --- a/data-explorer/kusto/query/has-operator.md +++ b/data-explorer/kusto/query/has-operator.md @@ -37,7 +37,9 @@ When possible, use the case-sensitive [has_cs](has-cs-operator.md). Rows in *T* for which the predicate is `true`. -## Example +## Examples + +The following example demonstrates using `has` with a case-insensitive search string. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"]