How to execute a returned KQL query

%3CLINGO-SUB%20id%3D%22lingo-sub-1241382%22%20slang%3D%22en-US%22%3EHow%20to%20execute%20a%20returned%20KQL%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1241382%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EQuick%20visualisation%20of%20one%20data%20record%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CTABLE%20border%3D%221%22%20width%3D%22100%25%22%3E%3CTBODY%3E%3CTR%3E%3CTD%20width%3D%2250%25%22%3EID%3C%2FTD%3E%3CTD%20width%3D%2250%25%22%3E1001%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%20width%3D%2250%25%22%3EDescription%3C%2FTD%3E%3CTD%20width%3D%2250%25%22%3ESample%20Query%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%20width%3D%2250%25%22%3EQuery%3C%2FTD%3E%3CTD%20width%3D%2250%25%22%3E%7Bsome%20KQL%20query%7D%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20would%20like%20to%20get%20the%20query%20and%20execute%20it%20all%20within%20a%20KQL%20statement%2C%20something%20like%20this%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESampleTable%3C%2FP%3E%3CP%3E%7C%20where%20ID%20%3D%3D%20'1001'%3C%2FP%3E%3CP%3E%7C%20extend%20results%20%3D%20%3CSTRONG%3Erun_query%3C%2FSTRONG%3E(Query)%3C%2FP%3E%3CP%3E%7C%20extend%20results_parsed%20%3D%20parse_json(results)%3C%2FP%3E%3CP%3E%7C%20%7Bcount%20number%20of%20results%2C%20get%20the%20description%20of%20first%2010%20and%20add%20to%20query%20output%7D%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3CP%3Edimmi%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1241382%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1246099%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20execute%20a%20returned%20KQL%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1246099%22%20slang%3D%22en-US%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Ffunctions%2Fuser-defined-functions%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Ffunctions%2Fuser-defined-functions%3C%2FA%3E%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

Hi,

 

Quick visualisation of one data record:

 

ID1001
DescriptionSample Query
Query{some KQL query}

 

I would like to get the query and execute it all within a KQL statement, something like this:

 

SampleTable

| where ID == '1001'

| extend results = run_query(Query)

| extend results_parsed = parse_json(results)

| {count number of results, get the description of first 10 and add to query output}

 

Thanks!

dimmi

1 Reply