Forum Discussion
Need help with Azure log queries
Swapna Nethi
The query is aligned to KQL best practices, please note that the size of your query is due to the complexity.https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/best-practices
But, I think there are two good options available.
1. Use materialize() function:
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/materializefunction
2. Create your own functions:
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/functions
Both have similar goals but I can personally recommend the log query functions (option 2) since I have used it. With functions, you can keep your queries behind the scenes so when you are typing it, you can reduce complex queries to very few lines.
Besides that, since you are using various unions there, I think your query is good in terms of optimization or logic. You might want to use functions to reduce the query size though.
MicrosoftSwapna Nethi
The query is aligned to KQL best practices, please note that the size of your query is due to the complexity.
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/best-practices
But, I think there are two good options available.
1. Use materialize() function:
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/materializefunction
2. Create your own functions:
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/functions
Both have similar goals but I can personally recommend the log query functions (option 2) since I have used it. With functions, you can keep your queries behind the scenes so when you are typing it, you can reduce complex queries to very few lines.
Besides that, since you are using various unions there, I think your query is good in terms of optimization or logic. You might want to use functions to reduce the query size though.
jpmartinez , can you please give me some working examples on the creation and usage of functions?
