Microsoft Azure

KQL (Kusto Query Language)

Definition

A read-only query language optimized for exploring large volumes of logs, telemetry, and time series, with operators chained by pipes (|), such as where, summarize, and render.

Exam context

In DP-900 it is used in Fabric Real-Time Intelligence Eventhouses and Azure Data Explorer. In SC-900 it is the language of Microsoft Sentinel analytics rules and hunting, and of advanced hunting in the Defender portal.

Studying for one of these certifications?

KQL (Kusto Query Language) is a concept that can show up on the exam. Check the full guide to see it in context.