Kusto Query Language (KQL) (2024)

Kusto Query Language (KQL) is a language to query structured, semi-structured, and unstructured data. See Microsoft Documentation for a tutorial and reference.

In Optimizely Profile Store, KQL is used to query and analyze Track events data. See Track events and Filter Definition to understand the basics of KQL in both querying track events and working with filter definition, and some examples of KQL in Event Filter definition.

Limitations

See Also

two disadvantages of Microsoft sentinel using

• KQL is used for read-only requests to process data and return results. Create, update, or delete operations are not supported.
• When running KQL, there is a query timeout setting, so a query that is too complicated can return a bad request.
• Profile API limits query based on resource usage.
• When using preview endpoint to test KQL Query in an Event filter definition, the result is limited to 1000 results.

• Follow Query best practice from Microsoft.

• Limit the usage of queries that performs a table scan. For example, Events | sample 1  scans the whole table and retrieves one random record; thus, the query will run very slowly. For this case, use Events | take 1, which also returns one random record but without scanning the whole table, so the performance is significantly improved.

• Simplify the query as much as possible. For example:

  Instead of:

   Events | where DeviceId == "device1" | where DeviceId == "device2" | where DeviceId == "device3"

  The following code returns the same result but is more concise:

   Events | where DeviceId in ("device1", "device2", "device3")

• Query on the latest data, if possible. Querying older data would take a much longer time.

• Track events
• Filter Definition