KQL Queryset - Mastering Kusto Query Language

SQL thinks in sets. KQL thinks in pipelines. You know SELECT, FROM, WHERE — and it works. But when you have time series data with hundreds of thousands of events per second, SQL hits its limit. KQL thinks differently: not as a set, but as a pipeline. Today we learn what that pipeline looks like.

In this Fabric Friday episode, I walk through the KQL Queryset: where it sits in the RTI ecosystem (3 query layers), SQL vs KQL side-by-side with the explain keyword, the KQL execution pipeline as a funnel (table → where → project → summarize → sort → render), time series with make-series and anomaly detection, saving to Real-Time Dashboard with auto-refresh, and a decision tree for KQL vs SQL vs Python.

📋 Chapters:
00:00 Introduction — SQL hits its limit, KQL thinks in pipelines
00:35 Drawing: KQL Queryset in the RTI Ecosystem — 3 Query Layers
03:28 Demo: Create KQL Queryset + First Queries (take, where, summarize)
05:51 Drawing: SQL Declarative vs KQL Pipe-Forward — Side by Side
08:29 Drawing: KQL Execution Pipeline — The Funnel
10:04 Drawing: Time Series — make-series, Anomaly Detection, Forecasting
11:17 Demo: Time Series Queries + Anomaly Detection with Weather Data
13:18 Demo: Save to Real-Time Dashboard + Auto-Refresh
14:54 Drawing: Decision Tree — KQL Queryset vs Notebook vs SQL Endpoint
16:39 Demo: explain Keyword — Convert SQL to KQL
16:59 Community Q&A: SQL to KQL Mental Model (Think PowerShell Pipeline)
18:35 Q&A: make-series vs bin+summarize — When to Use Which
20:00 Q&A: KQL Queryset vs Power BI for Dashboards
21:05 Q&A: Sharing Queries Without Database Access
22:09 Q&A: Performance — 5 Common Mistakes to Avoid
23:14 Q&A: KQL in Notebooks (KQL Magic)
23:41 Pitfalls & Pro Tips
24:40 Outro

🔗 LINKS FROM THIS VIDEO

🔷 Getting Started
• Query data in a KQL queryset: https://learn.microsoft.com/en-us/fabric/real-time-intelligence/kusto-query-set?wt.mc_id=AZ-MVP-5003447
• Create a KQL queryset: https://learn.microsoft.com/en-us/fabric/real-time-intelligence/create-query-set?wt.mc_id=AZ-MVP-5003447
• Share KQL queries: https://learn.microsoft.com/en-us/fabric/real-time-intelligence/kusto-share-queries?wt.mc_id=AZ-MVP-5003447

🔷 SQL to KQL
• SQL to KQL cheat sheet: https://learn.microsoft.com/en-us/kusto/query/sql-cheat-sheet?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447
• KQL quick reference: https://learn.microsoft.com/en-us/kusto/query/kql-quick-reference?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447
• Query data using T-SQL: https://learn.microsoft.com/en-us/kusto/query/t-sql?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447

🔷 Core Operators
• where operator: https://learn.microsoft.com/en-us/kusto/query/where-operator?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447
• project operator: https://learn.microsoft.com/en-us/kusto/query/project-operator?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447
• summarize operator: https://learn.microsoft.com/en-us/kusto/query/summarize-operator?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447
• render operator: https://learn.microsoft.com/en-us/kusto/query/render-operator?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447
• let statement: https://learn.microsoft.com/en-us/kusto/query/let-statement?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447

🔷 Time Series & Anomaly Detection
• make-series operator: https://learn.microsoft.com/en-us/kusto/query/make-series-operator?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447
• Time series analysis: https://learn.microsoft.com/en-us/kusto/query/time-series-analysis?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447
• Anomaly detection & forecasting: https://learn.microsoft.com/en-us/kusto/query/anomaly-detection?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447
• series_decompose_anomalies(): https://learn.microsoft.com/en-us/kusto/query/series-decompose-anomalies-function?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447
• series_decompose_forecast(): https://learn.microsoft.com/en-us/kusto/query/series-decompose-forecast-function?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447

🔷 Dashboards & Copilot
• Create a Real-Time Dashboard: https://learn.microsoft.com/en-us/fabric/real-time-intelligence/dashboard-real-time-create?wt.mc_id=AZ-MVP-5003447
• Copilot for writing KQL queries: https://learn.microsoft.com/en-us/fabric/real-time-intelligence/copilot-writing-queries?wt.mc_id=AZ-MVP-5003447

🔷 Interactive Learning
• Kusto Detective Agency (gamified KQL): https://detective.kusto.io/
• Azure Data Explorer free cluster: https://dataexplorer.azure.com/clusters/help

📺 RELATED EPISODES
⬅️ Week 16 — KQL Database: https://youtu.be/z57H_Zqvbkc
➡️ Week 18 — Real-Time Hub: Coming May 1st

📊 Fabric Periodic Table: https://fabric-periodic-table.com

👤 About me:
Matthias Falland – The Trusted Advisor
Microsoft Data Platform MVP
🌐 https://www.the-trusted-advisor.com
🔗 LinkedIn: https://www.linkedin.com/in/intune/
🎓 Fabric Periodic Table: https://fabric-periodic-table.com

📍 Fabric Community Meetup (Zürich/Hamburg/Basel):
https://www.meetup.com/ai-and-intelligent-cloud/

Видео KQL Queryset - Mastering Kusto Query Language канала Matthias Falland -The Trusted Advisor- Fabric & AI