Category SQL Query Kusto Query

Select data from SELECT * FROM dependencies dependencies

table
SELECT name, resultCode FROM dependencies dependencies | project name, resultCode
--
SELECT TOP 100 * FROM dependencies dependencies | take 100
--
Null evaluation SELECT * FROM dependencies
WHERE resultCode IS NOT NULL
dependencies
| where isnotnull(resultCode)
SELECT * FROM dependencies dependencies
Comparison WHERE timestamp > getdate()-1 | where timestamp > ago(1d)
operators (date)
SELECT * FROM dependencies dependencies
-- WHERE timestamp BETWEEN ... AND ... | where timestamp > datetime(2016-10-01)
  and timestamp <= datetime(2016-11-01)
SELECT * FROM dependencies dependencies
Comparison WHERE type = "Azure blob" | where type == "Azure blob"
operators
(string)
-- substring // substring
-- SELECT * FROM dependencies dependencies
WHERE type like "%blob%" | where type contains "blob"
-- wildcard // wildcard
-- SELECT * FROM dependencies dependencies
WHERE type like "Azure%" | where type startswith "Azure"
// or
dependencies
| where type matches regex "^Azure.*"
SELECT * FROM dependencies dependencies
Comparison WHERE !(success) | where success == "False"
(boolean)
SELECT name, AVG(duration) FROM dependencies
Grouping, dependencies | summarize avg(duration) by name
Aggregation GROUP BY name
SELECT DISTINCT name, type FROM dependencies
Distinct dependencies | summarize by name, type
SELECT name, COUNT(DISTINCT type) dependencies
-- FROM dependencies | summarize by name, type | summarize
GROUP BY name count() by name
// or approximate for large sets
dependencies
| summarize dcount(type) by name
SELECT operationName as Name, AVG(duration) dependencies
Column aliases, as AvgD FROM dependencies | summarize AvgD = avg(duration) by
Extending GROUP BY name Name=operationName
SELECT conference, CONCAT(sessionid, ' ' , ConferenceSessions
-- session_title) AS session FROM | extend session=strcat(sessionid, " ",
ConferenceSessions session_title)
| project conference, session
SELECT name, timestamp FROM dependencies dependencies
Ordering ORDER BY timestamp ASC | project name, timestamp
| order by timestamp asc nulls last
SELECT TOP 100 name, COUNT(*) as Count FROM dependencies
Top n by dependencies | summarize Count = count() by name
measure GROUP BY name | top 100 by Count desc
ORDER BY Count DESC
Category SQL Query Kusto Query
SELECT * FROM dependencies union dependencies, exceptions
Union UNION
SELECT * FROM exceptions
SELECT * FROM dependencies dependencies
-- WHERE timestamp > ... | where timestamp > ago(1d)
UNION | union
SELECT * FROM exceptions   (exceptions
WHERE timestamp > ...   | where timestamp > ago(1d))
SELECT * FROM dependencies dependencies
Join LEFT OUTER JOIN exception | join kind = leftouter
ON dependencies.operation_Id =   (exceptions)
exceptions.operation_Id on $left.operation_Id == $right.operation_Id
SELECT * FROM dependencies dependencies
Nested queries WHERE resultCode == | where resultCode == toscalar(
(SELECT TOP 1 resultCode FROM dependencies   dependencies
WHERE resultId = 7   | where resultId == 7
ORDER BY timestamp DESC)   | top 1 by timestamp desc
  | project resultCode)
SELECT COUNT(*) FROM dependencies dependencies
Having GROUP BY name | summarize Count = count() by name
HAVING COUNT(*) > 3 | where Count > 3