@@ -322,6 +322,7 @@ required_capability: kql_function_options
322322FROM logs
323323| WHERE KQL("@timestamp > \"2023-10-23T09:56:00\" AND @timestamp < \"2023-10-23T09:57:00\"", {"time_zone": "America/New_York"})
324324| KEEP @timestamp, message
325+ | SORT @timestamp ASC
325326;
326327
327328@timestamp:date | message:text
@@ -352,16 +353,15 @@ required_capability: kql_function_options
352353
353354FROM employees METADATA _score
354355| WHERE KQL("job_positions: Support Engineer", {"boost": 2.5})
355- | KEEP emp_no, first_name, last_name, job_positions, _score
356- | EVAL _score = round(_score, 2)
356+ | KEEP emp_no, first_name, last_name, job_positions
357357| SORT emp_no
358358| LIMIT 3
359359;
360360
361- emp_no:integer | first_name:keyword | last_name:keyword | job_positions:keyword | _score:double
362- 10004 | Chirstian | Koblick | [Head Human Resources, Reporting Analyst, Support Engineer, Tech Lead] | 6.81
363- 10015 | Guoxiang | Nooteboom | [Head Human Resources, Junior Developer, Principal Support Engineer, Support Engineer] | 6.81
364- 10021 | Ramzi | Erde | Support Engineer | 6.81
361+ emp_no:integer | first_name:keyword | last_name:keyword | job_positions:keyword
362+ 10004 | Chirstian | Koblick | [Head Human Resources, Reporting Analyst, Support Engineer, Tech Lead]
363+ 10015 | Guoxiang | Nooteboom | [Head Human Resources, Junior Developer, Principal Support Engineer, Support Engineer]
364+ 10021 | Ramzi | Erde | Support Engineer
365365;
366366
367367kqlWithMultipleOptions
0 commit comments