KQL quick reference

Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

This article shows you a list of functions and their descriptions to help get you started using Kusto Query Language.

Operator/Function	Description	Syntax
Filter/Search/Condition	Find relevant data by filtering or searching
where	Filters on a specific predicate	T | where Predicate
where contains/has	Contains: Looks for any substring match Has: Looks for a specific word (better performance)	T | where col1 contains/has "[search term]"
search	Searches all columns in the table for the value	[TabularSource |] search [kind=CaseSensitivity] [in (TableSources)] SearchPredicate
take	Returns the specified number of records. Use to test a query Note: take and limit are synonyms.	T | take NumberOfRows
case	Adds a condition statement, similar to if/then/elseif in other systems.	case(predicate_1, then_1, predicate_2, then_2, predicate_3, then_3, else)
distinct	Produces a table with the distinct combination of the provided columns of the input table	distinct [ColumnName], [ColumnName]
Date/Time	Operations that use date and time functions
ago	Returns the time offset relative to the time the query executes. For example, ago(1h) is one hour before the current clock's reading.	ago(a_timespan)
format_datetime	Returns data in various date formats.	format_datetime(datetime , format)
bin	Rounds all values in a timeframe and groups them	bin(value,roundTo)
Create/Remove Columns	Add or remove columns in a table
print	Outputs a single row with one or more scalar expressions	print [ColumnName =] ScalarExpression [',' ...]
project	Selects the columns to include in the order specified	T | project ColumnName [= Expression] [, ...] Or T | project [ColumnName | (ColumnName[,]) =] Expression [, ...]
project-away	Selects the columns to exclude from the output	T | project-away ColumnNameOrPattern [, ...]
project-keep	Selects the columns to keep in the output	T | project-keep ColumnNameOrPattern [, ...]
project-rename	Renames columns in the result output	T | project-rename new_column_name = column_name
project-reorder	Reorders columns in the result output	T | project-reorder Col2, Col1, Col* asc
extend	Creates a calculated column and adds it to the result set	T | extend [ColumnName | (ColumnName[, ...]) =] Expression [, ...]
Sort and Aggregate Dataset	Restructure the data by sorting or grouping them in meaningful ways
sort operator	Sort the rows of the input table by one or more columns in ascending or descending order	T | sort by expression1 [asc|desc], expression2 [asc|desc], …
top	Returns the first N rows of the dataset when the dataset is sorted using by	T | top numberOfRows by expression [asc|desc] [nulls first|last]
summarize	Groups the rows according to the by group columns, and calculates aggregations over each group	T | summarize [[Column =] Aggregation [, ...]] [by [Column =] GroupExpression [, ...]]
count	Counts records in the input table (for example, T) This operator is shorthand for summarize count()	T | count
join	Merges the rows of two tables to form a new table by matching values of the specified column(s) from each table. Supports a full range of join types: fullouter, inner, innerunique, leftanti, leftantisemi, leftouter, leftsemi, rightanti, rightantisemi, rightouter, rightsemi	LeftTable | join [JoinParameters] ( RightTable ) on Attributes
union	Takes two or more tables and returns all their rows	[T1] | union [T2], [T3], …
range	Generates a table with an arithmetic series of values	range columnName from start to stop step step
Format Data	Restructure the data to output in a useful way
lookup	Extends the columns of a fact table with values looked-up in a dimension table	T1 | lookup [kind = (leftouter|inner)] ( T2 ) on Attributes
mv-expand	Turns dynamic arrays into rows (multi-value expansion)	T | mv-expand Column
parse	Evaluates a string expression and parses its value into one or more calculated columns. Use for structuring unstructured data.	T | parse [kind=regex [flags=regex_flags] |simple|relaxed] Expression with * (StringConstant ColumnName [: ColumnType]) *...
make-series	Creates series of specified aggregated values along a specified axis	T | make-series [MakeSeriesParamters] [Column =] Aggregation [default = DefaultValue] [, ...] on AxisColumn from start to end step step [by [Column =] GroupExpression [, ...]]
let	Binds a name to expressions that can refer to its bound value. Values can be lambda expressions to create query-defined functions as part of the query. Use let to create expressions over tables whose results look like a new table.	let Name = ScalarExpression | TabularExpression | FunctionDefinitionExpression
General	Miscellaneous operations and function
invoke	Runs the function on the table that it receives as input.	T | invoke function([param1, param2])
evaluate pluginName	Evaluates query language extensions (plugins)	[T |] evaluate [ evaluateParameters ] PluginName ( [PluginArg1 [, PluginArg2]... )
Visualization	Operations that display the data in a graphical format
render	Renders results as a graphical output	T | render Visualization [with (PropertyName = PropertyValue [, ...] )]

Related content

• SQL cheat sheet
• Splunk cheat sheet