Querying and reshaping event data with KQL

In Microsoft Fabric, KQL (Kusto Query Language) is used to query and transform data stored in Eventhouse KQL databases, typically for real-time or high-volume analytical workloads. Learners create KQL Querysets to write, run, and save KQL queries against tables, and can also use KQL for lightweight transformations before or during ingestion.

1 · Learn the must-know

• 1KQL queries follow a tabular, pipe (|) based syntax where operators like where, extend, summarize, and project are chained left to right to progressively filter and shape data.
• 2The 'let' statement can define reusable variables or scalar/tabular expressions to simplify complex queries.
• 3Update policies allow automatic transformation of data as it lands in a source table, writing derived/transformed results into a target table without manual re-run of queries.
• 4The mv-expand operator is used to expand dynamic (JSON-like) arrays or property bags into multiple rows for easier analysis.
• 5KQL Querysets in Fabric can connect to one or more KQL databases (and cross-query with Lakehouse/Warehouse via appropriate connectors), and results can be visualized or pinned to dashboards.
• 6Functions such as bin(), ago(), and datetime() are commonly used for time-series bucketing and filtering, which is a core use case for KQL-based Eventhouse data.

2 · Check your understanding