SQL to Kusto query translation
Kusto supports subset of SQL language. See the list of SQL known issues
(../api/tds/sqlknownissues.html) for the full list of unsupported features.
Primary language to interact with Kusto is KQL (Kusto Query Language), and in order to make
transition and learning experience easier, you can use Kusto service to translate SQL queries to KQL.
This can be achieved by sending SQL query to Kusto services prefixing it with 'EXPLAIN' verb.
For example:
[Click to run the query] (https://help.kusto.windows.net:443/Samples?query=H4sIAAAAAAAEAONyjQjwc
EXPLAIN
SELECT COUNT_BIG(*) as C FROM StormEvents
Query
StormEvents
SQL to Kusto cheat sheet
The table below shows sample queries in SQL and thier KQL equivalients.
Category SQL Query Kusto Query
Select data from SELECT * FROM dependencies dependencies
table
-- SELECT name, resultCode FROM dependencies | project name,
dependencies resultCode
-- SELECT TOP 100 * FROM dependencies dependencies | take 100
Null evaluation SELECT * FROM dependencies dependencies
WHERE resultCode IS NOT NULL | where isnotnull(resultCode)
Comparison SELECT * FROM dependencies dependencies
operatots (date) WHERE timestamp > getdate()-1 | where timestamp > ago(1d)
-- SELECT * FROM dependencies dependencies
WHERE timestamp BETWEEN ... AND ... | where timestamp >
datetime(2016-10-01)
and timestamp <=
datetime(2016-11-01)
Category SQL Query Kusto Query
Comparison SELECT * FROM dependencies dependencies
operators (string) WHERE type = "Azure blob" | where type == "Azure blob"
-- -- substring // substring
SELECT * FROM dependencies dependencies
WHERE type like "%blob%" | where type contains "blob"
-- -- wildcard // wildcard
SELECT * FROM dependencies dependencies
WHERE type like "Azure%" | where type startswith
"Azure"
// or
dependencies
| where type matches regex
"^Azure.*"
Comparison SELECT * FROM dependencies dependencies
(boolean) WHERE !(success) | where success == "False"
Distinct SELECT DISTINCT name, type FROM dependencies
dependencies | summarize by name, type
Grouping, SELECT name, AVG(duration) FROM dependencies
Aggregation dependencies | summarize avg(duration) by
GROUP BY name name
Column aliases, SELECT operationName as Name, dependencies
Extending AVG(duration) as AvgD FROM dependencies | summarize AvgD =
GROUP BY name avg(duration) by operationName
| project Name =
operationName, AvgD
Ordering SELECT name, timestamp FROM dependencies
dependencies | project name, timestamp
ORDER BY timestamp ASC | order by timestamp asc nulls
last
Top n by measure SELECT TOP 100 name, COUNT(*) as Count dependencies
FROM dependencies | summarize Count = count() by
GROUP BY name name
ORDER BY Count DESC | top 100 by Count desc
Union SELECT * FROM dependencies union dependencies,
UNION exceptions
SELECT * FROM exceptions
Category SQL Query Kusto Query
-- SELECT * FROM dependencies dependencies
WHERE timestamp > ... | where timestamp > ago(1d)
UNION | union
SELECT * FROM exceptions (exceptions
WHERE timestamp > ... | where timestamp >
ago(1d))
Join SELECT * FROM dependencies dependencies
LEFT OUTER JOIN exception | join kind = leftouter
ON dependencies.operation_Id = (exceptions)
exceptions.operation_Id on $left.operation_Id ==
$right.operation_Id
Nested queries SELECT * FROM dependencies dependencies
WHERE resultCode == | where resultCode ==
(SELECT TOP 1 resultCode FROM toscalar(
dependencies dependencies
WHERE resultId = 7 | where resultId == 7
ORDER BY timestamp DESC) | top 1 by timestamp desc
| project resultCode)
Having SELECT COUNT(*) FROM dependencies dependencies
GROUP BY name | summarize Count = count() by
HAVING COUNT(*) > 3 name
| where Count > 3
