KQL Queryset - Mastering Kusto Query Language

SQL thinks in sets. KQL thinks in pipelines. You know SELECT, FROM, WHERE — and it works. But when you have time series data with hundreds of thousands of events per second, SQL hits its limit. KQL thinks differently: not as a set, but as a pipeline. Today we learn what that pipeline looks like. In this Fabric Friday episode, I walk through the KQL Queryset: where it sits in the RTI ecosystem (3 query layers), SQL vs KQL side-by-side with the explain keyword, the KQL execution pipeline as a funnel (table → where → project → summarize → sort → render), time series with make-series and anomaly detection, saving to Real-Time Dashboard with auto-refresh, and a decision tree for KQL vs SQL vs Python. 📋 Chapters: 00:00 Introduction — SQL hits its limit, KQL thinks in pipelines 00:35 Drawing: KQL Queryset in the RTI Ecosystem — 3 Query Layers 03:28 Demo: Create KQL Queryset + First Queries (take, where, summarize) 05:51 Drawing: SQL Declarative vs KQL Pipe-Forward — Side by Side 08:29 Drawing: KQL Execution Pipeline — The Funnel 10:04 Drawing: Time Series — make-series, Anomaly Detection, Forecasting 11:17 Demo: Time Series Queries + Anomaly Detection with Weather Data 13:18 Demo: Save to Real-Time Dashboard + Auto-Refresh 14:54 Drawing: Decision Tree — KQL Queryset vs Notebook vs SQL Endpoint 16:39 Demo: explain Keyword — Convert SQL to KQL 16:59 Community Q&A: SQL to KQL Mental Model (Think PowerShell Pipeline) 18:35 Q&A: make-series vs bin+summarize — When to Use Which 20:00 Q&A: KQL Queryset vs Power BI for Dashboards 21:05 Q&A: Sharing Queries Without Database Access 22:09 Q&A: Performance — 5 Common Mistakes to Avoid 23:14 Q&A: KQL in Notebooks (KQL Magic) 23:41 Pitfalls & Pro Tips 24:40 Outro 🔗 LINKS FROM THIS VIDEO 🔷 Getting Started • Query data in a KQL queryset: https://learn.microsoft.com/en-us/fabric/real-time-intelligence/kusto-query-set?wt.mc_id=AZ-MVP-5003447 • Create a KQL queryset: https://learn.microsoft.com/en-us/fabric/real-time-intelligence/create-query-set?wt.mc_id=AZ-MVP-5003447 • Share KQL queries: https://learn.microsoft.com/en-us/fabric/real-time-intelligence/kusto-share-queries?wt.mc_id=AZ-MVP-5003447 🔷 SQL to KQL • SQL to KQL cheat sheet: https://learn.microsoft.com/en-us/kusto/query/sql-cheat-sheet?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 • KQL quick reference: https://learn.microsoft.com/en-us/kusto/query/kql-quick-reference?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 • Query data using T-SQL: https://learn.microsoft.com/en-us/kusto/query/t-sql?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 🔷 Core Operators • where operator: https://learn.microsoft.com/en-us/kusto/query/where-operator?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 • project operator: https://learn.microsoft.com/en-us/kusto/query/project-operator?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 • summarize operator: https://learn.microsoft.com/en-us/kusto/query/summarize-operator?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 • render operator: https://learn.microsoft.com/en-us/kusto/query/render-operator?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 • let statement: https://learn.microsoft.com/en-us/kusto/query/let-statement?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 🔷 Time Series & Anomaly Detection • make-series operator: https://learn.microsoft.com/en-us/kusto/query/make-series-operator?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 • Time series analysis: https://learn.microsoft.com/en-us/kusto/query/time-series-analysis?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 • Anomaly detection & forecasting: https://learn.microsoft.com/en-us/kusto/query/anomaly-detection?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 • series_decompose_anomalies(): https://learn.microsoft.com/en-us/kusto/query/series-decompose-anomalies-function?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 • series_decompose_forecast(): https://learn.microsoft.com/en-us/kusto/query/series-decompose-forecast-function?view=microsoft-fabric&wt.mc_id=AZ-MVP-5003447 🔷 Dashboards & Copilot • Create a Real-Time Dashboard: https://learn.microsoft.com/en-us/fabric/real-time-intelligence/dashboard-real-time-create?wt.mc_id=AZ-MVP-5003447 • Copilot for writing KQL queries: https://learn.microsoft.com/en-us/fabric/real-time-intelligence/copilot-writing-queries?wt.mc_id=AZ-MVP-5003447 🔷 Interactive Learning • Kusto Detective Agency (gamified KQL): https://detective.kusto.io/ • Azure Data Explorer free cluster: https://dataexplorer.azure.com/clusters/help 📺 RELATED EPISODES ⬅️ Week 16 — KQL Database: https://youtu.be/z57H_Zqvbkc ➡️ Week 18 — Real-Time Hub: Coming May 1st 📊 Fabric Periodic Table: https://fabric-periodic-table.com 👤 About me: Matthias Falland – The Trusted Advisor Microsoft Data Platform MVP 🌐 https://www.the-trusted-advisor.com 🔗 LinkedIn: https://www.linkedin.com/in/intune/ 🎓 Fabric Periodic Table: https://fabric-periodic-table.com 📍 Fabric Community Meetup (Zürich/Hamburg/Basel): https://www.meetup.com/ai-and-intelligent-cloud/