Query data in a KQL queryset

In this article, you learn how to use a KQL queryset. A KQL queryset lets you run queries, view results, and customize query results for data from different sources, such as an eventhouse or a KQL database.

You can also use a KQL queryset to run cross-service queries against an Azure Monitor Log Analytics workspace or an Application Insights resource.

KQL queryset uses Kusto Query Language (KQL) to create queries and also supports many SQL functions. For more information about the query language, see Kusto Query Language overview.

Prerequisites

• A workspace with a Microsoft Fabric-enabled capacity.
• A KQL database with editing permissions and data, or an Azure Data Explorer cluster and database with AllDatabaseAdmin permissions.

Select a data source

Queries run in the context of a data source. You can change the associated data source at any time and keep the queries saved in the query editor. You can associate your KQL queryset with multiple data source types, including a KQL database, an Azure Data Explorer cluster, or Azure Monitor.

Select the tab for your data source type.

A list of tables associated with this data source appears below the data source name.

Write a query

Now that you're connected to a data source, you can run queries against it. KQL queryset uses Kusto Query Language (KQL) to query data from any connected data source that you can access. To learn more about KQL, see Kusto Query Language overview.

The following examples use the public StormEvents.csv sample file.

1. Write or copy a query in the top pane of the KQL queryset.

2. Select the Run button, or press + to run the query.

   The query results appear in the results grid below the query pane. Notice the green check indicating that the query completed successfully, and the time used to compute the query results.

   👁 Screenshot of the KQL queryset showing the results of a query. Both the query and the results pane are highlighted.
   

Interact with data sources

The data source explorer lets you switch between the data sources connected to the current queryset tab.

At the top of the data source explorer pane, under Explorer, you can use the search bar to search for a specific data source. You can also use the database switcher below the search bar to expand the data source connections menu. Select the data source that you want to use. If you didn't rename the tab earlier, it's automatically named after the data source.

👁 Screenshot showing how to switch between data sources using the search bar and Database switcher in the Explorer pane.

The data source explorer pane has two sections. The upper section lists all items in the data source, and the lower section shows all available data sources in the queryset.

View items in the data source

The upper section of the data source explorer shows all items in the data source that you're using.

• Tables
• Materialized Views
• Shortcuts
• Functions

Select the arrow > to the left of the item that you want to expand. You can drill down to show more details by selecting the arrow > to the left of items in subsequent list levels. For example, under Tables, select the arrow > to the left of a table to show the list of columns in that table.

To open the action menu, hover over an item in the expanded list and select the More menu [...]. The menu includes the following options:

• Refresh database
• View data profile
• Explore data
• Insert: to create and copy a script
• Get data: to add a new data source
• Create a dashboard
• Delete table

Different actions are available for different item types.

👁 Screenshot showing the explorer pane, how to expand the list of items in your data source and where to find the More actions menu.

Browse available data sources

The lower section of the data source explorer shows all the available data sources that you add to the queryset.

To open the action menu, hover over the data source name and select the More menu [...]. The menu includes the following options:

• Refresh database
• Use this database: switch to use this data source in the current tab
• Query in a new tab: open this data source in a new tab in the queryset
• Remove source: removes all the databases in that data source
• Remove database: removes the selected database only
• Open in KQL database: opens this data source in a KQL database.

👁 Screenshot showing the lower section of the Explorer pane where all data sources that were added to your queryset are listed.

Manage queryset tabs

Within a KQL queryset, you can create multiple tabs. Each tab can be associated with a different KQL database. This setup lets you save queries for later use or share them with others to collaborate on data exploration. You can also change the KQL database associated with any tab, which lets you run the same query on data in different databases.

You can manage your tabs in the following ways:

• Change the existing data source connection: Under Explorer and the search bar, use the database switcher to expand the data source connections menu.
• Rename a tab: Next to the tab name, select the pencil icon.
• Add a new tab: On the right of the existing tabs in the command bar, select the plus +. Different tabs can be connected to different data sources.
• More actions: On the right side of the command bar, use the tab menu to manage multiple tabs in your queryset.
• Change tab positions: Use drag and drop gestures.

👁 Screenshot of the multiple tabs menu for managing multiple tabs in the KQL queryset.

Delete a KQL queryset

To delete your KQL queryset:

1. Select the workspace that contains your KQL queryset.

2. Hover over the KQL queryset that you want to delete. Select More [...], and then select Delete.

   👁 Screenshot of Microsoft Fabric workspace showing how to delete a KQL queryset.
   

Next step