Scribd
Upload
6 views

kustoSQL Cheatsheet

The document provides guidance on translating SQL queries to Kusto Query Language (KQL), highlighting that Kusto supports a subset of SQL features. It explains how to use the 'EXPLAIN' verb to convert SQL queries into KQL and includes a cheat sheet with examples of SQL queries alongside their KQL equivalents. Additionally, it outlines various SQL functionalities such as null evaluation, comparison operators, grouping, and joins, along with their KQL translations.

Uploaded by

praveenvirat0711
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
6 views

kustoSQL Cheatsheet

The document provides guidance on translating SQL queries to Kusto Query Language (KQL), highlighting that Kusto supports a subset of SQL features. It explains how to use the 'EXPLAIN' verb to convert SQL queries into KQL and includes a cheat sheet with examples of SQL queries alongside their KQL equivalents. Additionally, it outlines various SQL functionalities such as null evaluation, comparison operators, grouping, and joins, along with their KQL translations.

Uploaded by

praveenvirat0711
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

SQL to Kusto query translation

Kusto supports subset of SQL language. See the list of SQL known issues
(../api/tds/sqlknownissues.html) for the full list of unsupported features.

Primary language to interact with Kusto is KQL (Kusto Query Language), and in order to make
transition and learning experience easier, you can use Kusto service to translate SQL queries to KQL.
This can be achieved by sending SQL query to Kusto services prefixing it with 'EXPLAIN' verb.

For example:

[Click to run the query] (https://help.kusto.windows.net:443/Samples?query=H4sIAAAAAAAEAONyjQjwc


EXPLAIN
SELECT COUNT_BIG(*) as C FROM StormEvents

 

Query

StormEvents

SQL to Kusto cheat sheet


The table below shows sample queries in SQL and thier KQL equivalients.

Category SQL Query Kusto Query

Select data from SELECT * FROM dependencies dependencies


table

-- SELECT name, resultCode FROM dependencies | project name,


dependencies resultCode

-- SELECT TOP 100 * FROM dependencies dependencies | take 100

Null evaluation SELECT * FROM dependencies dependencies


WHERE resultCode IS NOT NULL | where isnotnull(resultCode)

Comparison SELECT * FROM dependencies dependencies


operatots (date) WHERE timestamp > getdate()-1 | where timestamp > ago(1d)

-- SELECT * FROM dependencies dependencies


WHERE timestamp BETWEEN ... AND ... | where timestamp >
datetime(2016-10-01)
and timestamp <=
datetime(2016-11-01)
Category SQL Query Kusto Query

Comparison SELECT * FROM dependencies dependencies


operators (string) WHERE type = "Azure blob" | where type == "Azure blob"

-- -- substring // substring
SELECT * FROM dependencies dependencies
WHERE type like "%blob%" | where type contains "blob"

-- -- wildcard // wildcard
SELECT * FROM dependencies dependencies
WHERE type like "Azure%" | where type startswith
"Azure"
// or
dependencies
| where type matches regex
"^Azure.*"

Comparison SELECT * FROM dependencies dependencies


(boolean) WHERE !(success) | where success == "False"

Distinct SELECT DISTINCT name, type FROM dependencies


dependencies | summarize by name, type

Grouping, SELECT name, AVG(duration) FROM dependencies


Aggregation dependencies | summarize avg(duration) by
GROUP BY name name

Column aliases, SELECT operationName as Name, dependencies


Extending AVG(duration) as AvgD FROM dependencies | summarize AvgD =
GROUP BY name avg(duration) by operationName
| project Name =
operationName, AvgD

Ordering SELECT name, timestamp FROM dependencies


dependencies | project name, timestamp
ORDER BY timestamp ASC | order by timestamp asc nulls
last

Top n by measure SELECT TOP 100 name, COUNT(*) as Count dependencies


FROM dependencies | summarize Count = count() by
GROUP BY name name
ORDER BY Count DESC | top 100 by Count desc

Union SELECT * FROM dependencies union dependencies,


UNION exceptions
SELECT * FROM exceptions
Category SQL Query Kusto Query

-- SELECT * FROM dependencies dependencies


WHERE timestamp > ... | where timestamp > ago(1d)
UNION | union
SELECT * FROM exceptions (exceptions
WHERE timestamp > ... | where timestamp >
ago(1d))

Join SELECT * FROM dependencies dependencies


LEFT OUTER JOIN exception | join kind = leftouter
ON dependencies.operation_Id = (exceptions)
exceptions.operation_Id on $left.operation_Id ==
$right.operation_Id

Nested queries SELECT * FROM dependencies dependencies


WHERE resultCode == | where resultCode ==
(SELECT TOP 1 resultCode FROM toscalar(
dependencies dependencies
WHERE resultId = 7 | where resultId == 7
ORDER BY timestamp DESC) | top 1 by timestamp desc
| project resultCode)

Having SELECT COUNT(*) FROM dependencies dependencies


GROUP BY name | summarize Count = count() by
HAVING COUNT(*) > 3 name
| where Count > 3

You might also like