Kusto Query Language (KQL) - Part 2

As mentioned in the course description for Part 1, there is a good chance you have already used Azure Data Explorer (ADX) to some degree without knowing it. If you have used Azure Security Center, Azure Sentinel, Application Insights, Resource Graph Explorer, or enabled diagnostics on your Azure resources, then you have used ADX. All these services rely on Log Analytics, which is built on top of ADX and is queried using KQL.

Like many other tools and products, ADX was started by a small group of engineers in Israel around 2015. They needed to solve a problem. A group of developers from Microsoft's Power BI team needed a high-performing big data solution to ingest and analyze their logging and telemetry data. So, of course, they built their own because they could not find a service that met all their needs. This resulted in the Azure Data Explorer, also known as Kusto.

So, what is ADX? It is a fully managed, append-only columnar store big data service capable of elastic scaling and ingesting literally hundreds of billions of rows daily. ADX offers:

• Low-latency ingestion and elastic scaling

• Security

• Cost-efficient (pay as you consume)

• High availability

• Time Series Analysis

• Super fast query performance via KQL

• Custom built solutions

Part 2 of this series of courses on Azure Data Explorer and KQL goes more deeply into ADX and covers more use cases for the Kusto Query Language. The more deeply you get into KQL the more you realize what an amazing query language it is. And, you will probably start wondering why SQL doesn't implement many of the features we covered in Part 1 and will cover in Part 2.

Will there be a Part 3? That is up to you. Tell us what you would like to see that we haven't yet already covered.