Localized reading guide
kqlPurpose, usage and source
KQL language expertise for writing correct, efficient Kusto Query Language queries. Covers syntax gotchas, join patterns, dynamic types, datetime pitfalls, regex patterns, serialization, memory management, result-size discipline, and advanced functions (geo, vector, graph). USE THIS SKILL whenever writing, debugging, or reviewing KQL queries — even simple ones — because the gotchas section prevents the most common errors that waste tool calls and cause expensive retry cascades. Trigger on: KQL, Kusto, ADX, Azure Data Explorer, Fabric Real-Time Intelligence, EventHouse, Log Analytics, log analysis, data exploration, time series, anomaly detection, summarize, where clause, join, extend, project, let statement, parse operator, extract function, any mention of pipe-forward query syntax.
Source retrieved:
- Source repository
- microsoft/skills
- SKILL.md
.github/skills/kql/SKILL.md- Repository stars
- 3,157
- Repository updated
- 2026-10-31
- Categories
- Data
- Last collected
License: MIT
Workflow excerpts are reading aids, not executable instructions from Codez. No third-party Skill was run to produce this page.
The purpose and workflow passages below are upstream material, organized and translated for reading. They are distinct from the separately labeled Codez editorial analysis.
What this Skill does
KQL language expertise for writing correct, efficient Kusto Query Language queries. Covers syntax gotchas, join patterns, dynamic types, datetime pitfalls, regex patterns, serialization, memory management, result-size discipline, and advanced functions (geo, vector, graph). USE THIS SKILL whenever writing, debugging, or reviewing KQL queries — even simple ones — because the gotchas section prevents the most common errors that waste tool calls and cause expensive retry cascades. Trigger on: KQL, Kusto, ADX, Azure Data Explorer, Fabric Real-Time Intelligence, EventHouse, Log Analytics, log analysis, data exploration, time series, anomaly detection, summarize, where clause, join, extend, project, let statement, parse operator, extract function, any mention of pipe-forward query syntax.
How the upstream workflow works
KQL Mastery
> Try it yourself: All ✅ examples in this skill can be run against the public help cluster: > https://help.kusto.windows.net, database Samples (contains StormEvents, SimpleGraph_Nodes/Edges, nyc_taxi, and more).
1. KQL Basics
Kusto Query Language (KQL) is a pipe-forward query language for exploring data. It is the native query language for Azure Data Explorer (ADX), Microsoft Fabric Real-Time Intelligence (EventHouse), Azure Monitor Log Analytics, Microsoft Sentinel, and other Microsoft data services.
Upstream passage · L11 ↗Pipe-forward syntax
KQL queries are a chain of operators separated by |. Data flows left to right:
StormEvents // start with a table
| where State == "TEXAS" // filter rows
| summarize count() by EventType // aggregate
| top 5 by count_ desc // limit resultsRequirements and setup
5. Serialization Requirements
Window functions need serialized (ordered) input. Functions requiring serialization: row_number(), row_cumsum(), prev(), next(), row_window_session().
Limits and quality checks
Equality only
KQL join conditions support only ==. No , !=, or function calls in join predicates. For range joins, pre-bin values: | extend bin_val = bin(Value, 100), then join on bin_val. Note: values near bin boundaries may land in adjacent bins — consider checking neighboring bins or overlapping the range for precision.
Start with a safe trial
- Check the supported host and the repository installation instructions. Keep the Skill directory and its referenced scripts, assets and documentation together; SKILL.md alone may omit dependencies.
- Give the agent your real input, desired output and acceptance criteria. Invocation syntax and available tools depend on the host; this site does not assume a universal install command.
- Try the source workflow in a disposable project or on a copy. Review operations that change files, remote services or billable resources before allowing them.
- Validate the output against the source quality checks and your own requirements. A successful trigger or a high repository Star count does not establish a correct result.
Read further in the source
- KQL Mastery
- 1. KQL Basics
- Pipe-forward syntax
- Query vs management commands
- 2. Dynamic Type Discipline
- 3. Join Patterns & Pitfalls
- Equality only
- Left/right attribute matching
- Cardinality check before large joins
- 4. Regex in KQL
- The
extract_allgotcha - 5. Serialization Requirements
- 6. Memory-Safe Query Patterns
- Rules for large tables (>1M rows)
- When you see
E_LOW_MEMORY_CONDITION - When you see
E_RUNAWAY_QUERY - 7. Result Size Discipline
- 8. String Comparison Strictness
- 9. Advanced Functions
- Time series
- 10. Self-Correction Lookup Table
- 11. Datetime Pitfalls
- 12. Operator Naming & Equality
- sort vs order
- 13. Error Recovery Strategy
- The correct pattern
- 14. Query Writing Checklist
Related Skills
Translation and scope
This reading guide selects passages from the pinned upstream SKILL.md. Translation is assisted. It is not a complete manual or a claim of tested compatibility. Read the original and its referenced files before use.
This introduction refers to the pinned version below; current repository activity and collection time are shown separately.
- Pinned source
- Read the original ↗
- Source retrieved
- Source commit
00d66a64919edca5bca2c673373444e36a4b5461- Source SHA-256
ffc1f17ed69d34dd5e8130cf1fc4adf9f3ea27410e8aa90f0cc1e5385f315ce2