Introducing the basics of KQL

Throughout this chapter, I will draw comparisons between SQL and KQL to demonstrate similarities and showcase the simplicity of KQL. Before we start to look at the basic data transformation operators, let's first look at how to query a table in the simplest form.

In SQL, if you want to query a table and return all columns and rows, you can execute a query as follows:

Select * from StormEvents

The query returns all the rows and columns for StormEvents. You can even execute the SQL query in the ADX Web UI. The equivalent query in KQL is simply the table name:

StormEvents

As shown in Figure 5.2, the query returns all rows and columns (59,066 records) in approximately 23 seconds:

Figure 5.2 – The simplest KQL query

This type of query can be expensive in terms of performance since it returns all records and columns, and tables can contain millions of records. This type of query is normally used with limit...