Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions data-explorer/dashboard-parameters.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,15 @@ title: Use parameters in Azure Data Explorer dashboards
description: Learn how to use parameters as a building block for dashboard filters.
ms.reviewer: gabil
ms.topic: how-to
ms.date: 06/05/2025
ms.date: 07/23/2026
ai-usage: ai-assisted
---

# Use parameters in Azure Data Explorer dashboards

Parameters are used as building blocks for filters in Azure Data Explorer dashboards. They're managed in the dashboard scope, and can be added to queries to filter the data presented by the underlying visual. A query can use one or more parameters.

This document describes the creation and use of parameters and linked filters in dashboards. Parameters can be used to filter dashboard visuals either by selecting [parameter values in the filter bar](#use-parameters-in-your-query) or by using [cross-filters](#cross-filters-parameters).
This article describes the creation and use of parameters and linked filters in dashboards. Use parameters to filter dashboard visuals either by selecting [parameter values in the filter bar](#use-parameters-in-your-query) or by using [cross-filters](#cross-filters-parameters).

> [!NOTE]
> Parameter management is available in **Editing** mode to dashboard editors.
Expand Down Expand Up @@ -77,10 +78,10 @@ The following indicators can be viewed in the parameter card:

## Use parameters in your query

A parameter must be used in the query to make the filter applicable for that query visual. Once defined, you can see the parameters in the **Query** page > filter top bar and in the query intellisense.
To make a filter work for a query visual, you must use a parameter in the query. When you define a parameter, you see it in the **Query** page filter top bar and in the query IntelliSense.

> [!NOTE]
> If the parameter isn't used in the query, the filter remains inactive. Once the parameter is added to the query, the filter becomes active.
> If you don't use the parameter in the query, the filter stays inactive. When you add the parameter to the query, the filter becomes active.

## Parameter types

Expand All @@ -107,7 +108,7 @@ StormEvents
| top 5 by TotalEvents
```

Once saved, the time range filter shows up on the dashboard. Now it can be used to filter the data on the card. You can filter your dashboard by selecting from the dropdown: **Time range** (last x minutes/hours/days) or a **Custom time range**.
After you save, the time range filter shows up on the dashboard. Now you can use it to filter the data on the card. You can filter your dashboard by selecting from the dropdown: **Time range** (last x minutes, hours, or days) or a **Custom time range**.

:::image type="content" source="media/dashboard-parameters/time-range-parameter.png" alt-text="Screenshot showing how to filter using custom time range.":::

Expand Down
52 changes: 26 additions & 26 deletions data-explorer/data-explorer-overview.md

Large diffs are not rendered by default.

9 changes: 5 additions & 4 deletions data-explorer/how-it-works.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,16 @@ title: How Azure Data Explorer works
description: 'Learn more about how Azure Data Explorer works.'
ms.reviewer: avnera
ms.topic: how-to
ms.date: 06/10/2025
ms.date: 07/23/2026
ai-usage: ai-assisted
---
# How Azure Data Explorer works

Azure Data Explorer provides unparalleled performance for ingesting and querying telemetry, logs, events, traces, and time series data. It features optimized storage formats, indexes, and uses advanced data statistics for efficient query planning and just-in-time compiled query execution.

## Storage vs. compute

Azure Data Explorer separates storage and compute resources. Persistent data resides in Azure Blob Storage, while compute resources may store temporary data or act as a cache for persistent storage.
Azure Data Explorer separates storage and compute resources. Persistent data resides in Azure Blob Storage, while compute resources might store temporary data or act as a cache for persistent storage.

This separation provides the following advantages:

Expand All @@ -32,15 +33,15 @@ For more information on data storage, see [Extents overview](/kusto/management/e

## Data cache

Azure Data Explorer has a multi-hierarchy data cache system to ensure that the most relevant data is cached as closely as possible to the CPU. The cache system depends on the immutability of extents, and works entirely with [compressed data](#column-compression). In order to improve query performance, data remains compressed even in RAM and is only decompressed when required for a query.
Azure Data Explorer uses a multilevel data cache system to keep the most relevant data as close as possible to the CPU. This cache system relies on the immutability of extents and works entirely with [compressed data](#column-compression). To boost query performance, data stays compressed even in RAM and is only decompressed when a query needs it.

For more information on caching, see [Cache policy](/kusto/management/cache-policy?view=azure-data-explorer&preserve-view=true).

## Text indexing

Azure Data Explorer is designed to efficiently index free-text ([string](/kusto/query/scalar-data-types/string?view=azure-data-explorer&preserve-view=true)) and JSON-like ([dynamic](/kusto/query/scalar-data-types/dynamic?view=azure-data-explorer&preserve-view=true)) columns as data is ingested. The indexes maintain a level of granularity that enables evaluation of parts of the query based on the index without scanning the data.

Continuous background optimization of extents through merging improves compression and indexing, ensuring efficient storage and low query latency. Once extents reach a certain size, only the indexes are merged to enhance query performance without compromising efficiency.
Continuous background optimization of extents through merging improves compression and indexing, ensuring efficient storage and low query latency. After extents reach a certain size, only the indexes merge to boost query performance without hurting efficiency.

For more information on extent and index merging, see [Merge policy](/kusto/management/merge-policy?view=azure-data-explorer&preserve-view=true).

Expand Down
10 changes: 6 additions & 4 deletions data-explorer/index.yml
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ metadata:
ms.topic: landing-page
author: spelluru
ms.author: spelluru
ms.date: 06/12/2025
ms.date: 07/23/2026

# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new

Expand Down Expand Up @@ -42,8 +42,10 @@ landingContent:
linkLists:
- linkListType: learn
links:
- text: "Free Pluralsight training: Azure Data Explorer"
url: https://www.pluralsight.com/browse
- text: Data analysis in Azure Data Explorer with Kusto Query Language
url: /training/paths/data-analysis-data-explorer-kusto-query-language/
- text: Kusto Query Language learning resources
url: kql-learning-resources.md
# Card
- title: Create cluster and database
linkLists:
Expand Down Expand Up @@ -102,7 +104,7 @@ landingContent:
- linkListType: tutorial
links:
- text: Write KQL queries
url: /azure/data-explorer/kusto/query/tutorials/learn-common-operators
url: /kusto/query/tutorials/learn-common-operators
- linkListType: how-to-guide
links:
- text: Query data in Azure Data Lake
Expand Down
16 changes: 11 additions & 5 deletions data-explorer/kql-learning-resources.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,29 +3,30 @@ title: Kusto Query Language learning resources
description: This article provides a list of different types of learning resources for ramping up on KQL.
ms.reviewer: alexans
ms.topic: concept-article
ms.date: 06/10/2025
ms.date: 07/23/2026
ai-usage: ai-assisted
---
# Kusto Query Language learning resources

Kusto Query Language (KQL) is a powerful tool to explore your data and discover patterns, identify anomalies and outliers, create statistical modeling, and more. Are you new to KQL or want to improve your KQL skills? Take a look at the following learning resources.
Kusto Query Language (KQL) is a powerful tool to explore your data and discover patterns, identify anomalies and outliers, create statistical models, and more. Are you new to KQL or do you want to improve your KQL skills? Take a look at the following learning resources.

For more information on KQL, see [KQL overview](/kusto/query/index?view=azure-data-explorer&preserve-view=true).

## General training

This training isn't product-specific, and provides basic KQL learning:
This training isn't product-specific and provides basic KQL learning:

* [Pluralsight: KQL from scratch](https://www.pluralsight.com/courses/kusto-query-language-kql-from-scratch)
* [Kusto Detective Agency](https://detective.kusto.io/)
* [Tutorial: Learn common operators](/kusto/query/tutorials/learn-common-operators?view=azure-data-explorer&preserve-view=true)
* [Tutorial: Use aggregation functions](/kusto/query/tutorials/use-aggregation-functions?view=azure-data-explorer&preserve-view=true)
* [Tutorial: Join data from multiple tables](/kusto/query/tutorials/join-data-from-multiple-tables?view=azure-data-explorer&preserve-view=true)
* [Cloud Academy: Introduction to Kusto Query Language](https://cloudacademy.com/lab/introduction-to-kusto-query-language/)
* [QA (formerly Cloud Academy): Introduction to Kusto Query Language](https://platform.qa.com/lab/introduction-to-kusto-query-language/)

## Azure Data Explorer

* [Tutorial: Create geospatial visualizations](/kusto/query/tutorials/create-geospatial-visualizations?view=azure-data-explorer&preserve-view=true)
* [Data analysis in Azure Data Explorer with Kusto Query Language](/training/paths/data-analysis-data-explorer-kusto-query-language/)
* [Free Pluralsight training: Azure Data Explorer](https://www.pluralsight.com/browse)

## Real-Time Intelligence in Microsoft Fabric

Expand All @@ -44,3 +45,8 @@ This training isn't product-specific, and provides basic KQL learning:
* [SC-200: Create queries for Microsoft Sentinel using Kusto Query Language (KQL)](/training/paths/sc-200-utilize-kql-for-azure-sentinel/)
* [Infosec Train: Kusto Query Language (KQL) eLearning Training Program Online](https://www.infosectrain.com/self-paced-learning/kusto-query-language-training/)

## Related content

* [KQL overview](/kusto/query/index?view=azure-data-explorer&preserve-view=true)
* [Tutorial: Learn common operators](/kusto/query/tutorials/learn-common-operators?view=azure-data-explorer&preserve-view=true)
* [Query data in the Azure Data Explorer web UI](web-query-data.md)
15 changes: 8 additions & 7 deletions data-explorer/kusto-emulator-install.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@ title: Install the Azure Data Explorer Kusto emulator
description: In this article, you learn how to install the Azure Data Explorer Kusto emulator and run your first query.
ms.reviewer: vplauzon
ms.topic: how-to
ms.date: 06/30/2025
ms.date: 07/23/2026
ai-usage: ai-assisted
ms.custom: sfi-image-nochange
---

Expand Down Expand Up @@ -39,7 +40,7 @@ This article focuses on how to install the Linux Docker container on a Windows c

> [!IMPORTANT]
> Linux distros only support Linux container images.
> ARM processors are not supported.
> ARM processors aren't supported.

## Install the Kusto emulator

Expand All @@ -52,7 +53,7 @@ The following steps are for using a shell to start the emulator using the [Kusto

> [!NOTE]
>
> - The first time this command is run, Docker pulls the container image which is several GBs in size and might take several minutes to download. Once downloaded, the image is cached and available for subsequent runs without having to download it again.
> - The first time you run this command, Docker pulls the container image, which is several GBs in size and might take several minutes to download. After it downloads, the image is cached and available for subsequent runs without having to download it again.

1. To start the Linux container, make sure you use the `latest` or `stable` tag:

Expand All @@ -74,7 +75,7 @@ The following steps are for using a shell to start the emulator using the [Kusto
a8b51bce21ad mcr.microsoft.com/azuredataexplorer/kustainer-linux:latest "powershell -Command¦" 11 minutes ago Up 10 minutes 0.0.0.0:8080->8080/tcp contoso
```

1. Run the following command to verify that Kusto emulator is running. This command is for PowerShell, you could do something similar using `curl` in a Linux environment. The command runs the `.show cluster` query against the management API and it should return a *StatusCode* with value *200*.
1. Run the following command to verify that the Kusto emulator is running. This command is for PowerShell; you can do something similar by using `curl` in a Linux environment. The command runs the `.show cluster` query against the management API and should return a *StatusCode* with value *200*.

```powershell
Invoke-WebRequest -Method post -ContentType 'application/json' -Body '{"csl":".show cluster"}' http://localhost:8080/v1/rest/mgmt
Expand Down Expand Up @@ -114,7 +115,7 @@ You can use any of the following options when running the emulator:
docker run -v d:\host\local:/kustodata -e ACCEPT_EULA=Y -m 4G -d -p 8080:8080 -t mcr.microsoft.com/azuredataexplorer/kustainer-linux:latest
```

- Run on a different port: The Kusto emulator exposes access to the Kusto Query Engine on port 8080; hence in other examples you mapped the host port 8080 to the emulator port 8080. You can use this option to map a different host to the engine.
- Run on a different port: The Kusto emulator exposes access to the Kusto Query Engine on port 8080. In other examples, you mapped the host port 8080 to the emulator port 8080. Use this option to map a different host port to the engine.

For example, to map port 9000 on the host to the engine, use the following command on Windows Server:

Expand Down Expand Up @@ -150,9 +151,9 @@ In the following sections, you use Kusto.Explorer to create a database, ingest d

To store data and run queries, create a database or attach the emulator to an existing database.

A database can be persisted in a container folder or on a [mounted folder](#run-emulator-options). The former's lifetime is bound to the container, so restarting the container loses any changes. Also, the container virtual storage is less efficient than native one. Mounted folder enables you to keep the data between container runs.
You can persist a database in a container folder or on a [mounted folder](#run-emulator-options). A container folder's lifetime is bound to the container, so restarting the container loses any changes. Also, the container's virtual storage is less efficient than native storage. A mounted folder enables you to keep the data between container runs.

In this example, we keep the data on the container.
In this example, you keep the data in the container.

In the [Kusto.Explorer Query mode](/kusto/tools/kusto-explorer-using?view=azure-data-explorer&preserve-view=true#query-mode), run the following command to create a persistent database:

Expand Down
17 changes: 9 additions & 8 deletions data-explorer/kusto/api/get-started/app-basic-query.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@ title: Create an app to run basic queries
description: Learn how to create an app to run basic queries using Kusto client libraries.
ms.reviewer: yogilad
ms.topic: how-to
ms.date: 05/28/2025
ms.date: 07/23/2026
ai-usage: ai-assisted
ms.custom: sfi-ropc-nochange
#customer intent: To learn about creating an app to run basic queries using Kusto client libraries.
---
Expand All @@ -26,7 +27,7 @@ In this article, you learn how to:

## Run a basic query and process the results

In your preferred IDE or text editor, create a project or file named *basic query* using the convention appropriate for your preferred language. Then add the following code:
In your IDE or text editor, create a project or file named *basic query* by using the naming convention for your language. Then add the following code:

1. Create a client app that connects to the [help cluster](https://dataexplorer.azure.com/clusters/help).

Expand Down Expand Up @@ -112,7 +113,7 @@ In your preferred IDE or text editor, create a project or file named *basic quer

---

1. Define the database and query to run. The query returns the date, state, and total tornado related damage where the total damage exceeded 100 million dollars.
1. Define the database and query to run. The query returns the date, state, and total tornado-related damage where the total damage exceeds $100 million.

### [C\#](#tab/csharp)

Expand Down Expand Up @@ -433,7 +434,7 @@ For example, you can modify the previous code to access the values of the `Start

### [C\#](#tab/csharp)

In C#, you can only access the values of the columns by their ordinal positions in the result set. You can't use the column names; hence, the code remains the same.
In C#, you can only access the values of the columns by their ordinal positions in the result set. You can't use the column names, so the code remains the same.

```csharp
int columnNoStartTime = response.GetOrdinal("StartTime");
Expand Down Expand Up @@ -564,13 +565,13 @@ KustoOperationResult response = kusto_client.execute(database, query, crp);

## Use query parameters to protect user input

Query parameters are important for maintaining the security and protection of your data. It safeguards it from potential malicious actors that may attempt to gain unauthorized access to or corrupt your data. For more information about parameterized queries, see [Query parameters declaration statement](../../query/query-parameters-statement.md).
Query parameters help protect your data. They safeguard it from malicious actors who might attempt to gain unauthorized access to or corrupt your data. For more information about parameterized queries, see [Query parameters declaration statement](../../query/query-parameters-statement.md).

For example, you can modify the previous code to pass the *EventType* value and *DailyDamage* minimum value as parameters to the query. To use parameters:

1. Declare the parameters in the query text
1. Substitute the property values in the query text with the parameter names
1. Set the parameter values in the client request properties passed to the execute method
1. Declare the parameters in the query text.
1. Substitute the property values in the query text with the parameter names.
1. Set the parameter values in the client request properties passed to the execute method.

### [C\#](#tab/csharp)

Expand Down
Loading