Analyzing Data Stores

A Kusto query is a read-only request that processes data that is organized into a hierarchy of databases, tables, and columns, similar to SQL.

Query statements are separated by a ;, and only affect the query at hand. There are 3 kinds of user query statements: tabular expression statements, let statements, and set statements.

The most common kind is the tabular expression statement where the input and the output consist of tables. Tabular statements contain zero or more operators that are sequenced by a | (pipe). Each time the data passes through another operator, it’s filtered, rearranged, or summarized. Because the piping is sequential, the query operator order can affect both results and performance.

Count rows

How many storm records are there in the table?

StormEvents
| count

See a sample of data

Sample N rows from the StormEvents table.

StormEvents
| take 2

Aggregation functions allow you to group and combine data from multiple rows into a summary value.

Use the summarize operator

Find the number of events by state.

StormEvents
| summarize TotalStorms = count() by State

summarize groups together rows based on the by clause and uses the aggregation function to combine each group into a single row.

Visualize query results

Show a bar chart for the number of storm events by state for the top 5 states.