I have a first KQL query that returns a list of domain names, and then I want to use these to filter another KQL query. I just can't figure out the syntax to do it. Is there a way to…
I have a column,['timestamp'] in Azure Data Explorer. A certain value, x, is assigned to this timestamp. Data is being streamed in real time and I would like to take the last value of yesterday's data. However, when I do…
I'm new to Kusto. I'm trying to follow this guide that should help me identify unused resources on Azure. The first command is pretty easy: resources | where type == "microsoft.compute/disks" But it fails miserably with the error: Request is…
Let's say I have a KQL query that uses several tables to retrieve the data. I need to write some code in C#, that will take all the tables used by a given KQL query, and put all those table…
I am having the following problem and an extensive search online didn't provide any good results. When trying to access my Azure Data Explorer Database and querying using the Kusto.Data SDK in an Azure Function, it yields the following error:…
I have to ingest data from ADLS gen2 to tables in ADX. I first tried to use ADF, but considering the run time and everything, this was an really inefficient way to do it. I think it would be so…
Im trying to ingest data from a json file and generate new columns with transformed data. Im trying to do sth like that but cannot find the way to solve it. .create table example ingestion json mapping "example_mapping" '[' '{…
I have millions of records in Azure Data Explorer. Each of this record has a timestamp value associated with it. I want to be able to convert this timestamp value in the specific time zone. For example in SQL I…
for several days I'm trying to ingest Apache Avro formatted data from a blob storage into the Azure Data Explorer. I'm able to reference the toplevel JSON-keys like $.Body (see red underlined example in the screenshot below), but when it…
In a workbook, I'm displaying a time chart comparing throttle vs non-throttle requests. The query employs a summarize operator, and while it functions properly, it frequently encounters the "too many datapoints (10000)" error. I attempted to use the limit operator,…