Tutorial: Learn common operators

Select a service from the drop-down list to the left.
Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Use Kusto Query Language (KQL) to write queries in Azure Data Explorer, Azure Monitor Log Analytics, Microsoft Sentinel, and more. This tutorial introduces the essential KQL operators you can use to access and analyze your data.

For more specific guidance on how to query logs in Azure Monitor, see Get started with log queries.

In this tutorial, you learn how to:

Prerequisites

To run the following queries, you need a query environment with access to the sample data. You can use one of the following options:

Count rows

Begin by using the count operator to find the number of storm records in the StormEvents table.

StormEvents 
| count

Output

See a sample of data

To get a sense of the data, use the take operator to view a sample of records. This operator returns a specified number of arbitrary rows from the table, which can be useful for previewing the general data structure and contents.

StormEvents 
| take 5

The following table shows only five of the 22 returned columns. To see the full output, run the query.

Select a subset of columns

Use the project operator to simplify the view and select a specific subset of columns. Using project is often more efficient and easier to read than viewing all columns.

StormEvents
| take 5
| project State, EventType, DamageProperty

Output

List unique values

The results of the previous query show that there are multiple types of storms. Use the distinct operator to list all of the unique storm types.

StormEvents 
| distinct EventType

The table contains 46 types of storms. Here's a sample of 10 of them.

Sort results

To view the top floods in Texas that caused the most damage, use the sort operator to arrange the rows in descending order based on the DamageProperty column. The default sort order is descending. To sort in ascending order, specify asc.

StormEvents
| where State == 'TEXAS' and EventType == 'Flood'
| sort by DamageProperty
| project StartTime, EndTime, State, EventType, DamageProperty

Output

Filter by condition

The where operator filters rows of data based on certain criteria.

The following query looks for storm events in a specific State of a specific EventType.

StormEvents
| where State == 'TEXAS' and EventType == 'Flood'
| project StartTime, EndTime, State, EventType, DamageProperty

There are 146 events that match these conditions. Here's a sample of five of them.

Filter by date and time range

Use the between operator to filter data based on a specific time range.

The following query finds all storm events between August 1, 2007, and August 30, 2007, along with their states, event types, start times, and end times. The query returns results sorted in ascending order by start time.

StormEvents
| where StartTime between (datetime(2007-08-01 00:00:00) .. datetime(2007-08-30 23:59:59))
| project State, EventType, StartTime, EndTime
| sort by StartTime asc 

Output

Get the top n rows

The top operator returns the first n rows sorted by the specified column.

The following query returns the five Texas floods that caused the most damaged property.

StormEvents
| where State == 'TEXAS' and EventType == 'Flood'
| top 5 by DamageProperty
| project StartTime, EndTime, State, EventType, DamageProperty

Output

Create calculated columns

You can use the project and extend operators to create calculated columns.

Use project to specify only the columns you want to view. Use extend to add the calculated column to the end of the table.

The following query creates a calculated Duration column with the difference between the StartTime and EndTime. Since you only want to view a few select columns, using project is the better choice in this case.

StormEvents
| where State == 'TEXAS' and EventType == 'Flood'
| top 5 by DamageProperty desc
| project StartTime, EndTime, Duration = EndTime - StartTime, DamageProperty

Output

If you take a look at the computed Duration column, you might notice that the flood that caused the most damage was also the longest flood.

Use extend to view the calculated Duration column along with all of the other columns. The Duration column is added as the last column.

StormEvents
| where State == 'TEXAS' and EventType == 'Flood'
| top 5 by DamageProperty desc
| extend Duration = EndTime - StartTime

Output

Map values from one set to another

Static mapping is a useful technique for changing the presentation of your results. In KQL, you can perform static mapping by using a dynamic dictionary and accessors to map values from one set to another.

let sourceMapping = dynamic(
  {
    "Emergency Manager" : "Public",
    "Utility Company" : "Private"
  });
StormEvents
| where Source == "Emergency Manager" or Source == "Utility Company"
| project EventId, Source, FriendlyName = sourceMapping[Source]

Output

Next step

Now that you're familiar with the essentials of writing Kusto queries, go on to the next tutorial and learn how to use aggregation functions to gain deeper insight into your data.