Skills · SkillWriting & ContentReviewed

kql

KQL expertise for writing correct, efficient Kusto queries: syntax gotchas, joins, dynamic types, datetime pitfalls, regex and serialization.

View on GitHub

Kind: Skill
Works with: GitHub Copilot
Source: microsoft/skills @ 2130750147de
Path: .github/skills/kql/SKILL.md
License: MIT
Jobs: Implementation, Debugging

InstallCopy it from the source repository, or sign in and let the assistant adapt it for your project.

# KQL Mastery

> **Try it yourself**: All `✅` examples in this skill can be run against the public help cluster:
> `https://help.kusto.windows.net`, database `Samples` (contains `StormEvents`, `SimpleGraph_Nodes`/`Edges`, `nyc_taxi`, and more).

## 1. KQL Basics

Kusto Query Language (KQL) is a pipe-forward query language for exploring data. It is the native query language for Azure Data Explorer (ADX), Microsoft Fabric Real-Time Intelligence (EventHouse), Azure Monitor Log Analytics, Microsoft Sentinel, and other Microsoft data services.

### Pipe-forward syntax

KQL queries are a chain of operators separated by `|`. Data flows left to right:

```kql
StormEvents                          // start with a table
| where State == "TEXAS"             // filter rows
| summarize count() by EventType     // aggregate
| top 5 by count_ desc              // limit results
```

### Query vs management commands

KQL has two execution planes:

| Plane | Starts with | Examples |
|-------|-------------|----------|
| **Query** | Table name, `let`, `print`, `datatable` | `StormEvents \| where State == "TEXAS"` |
…