KQL schedued query with cached query result

[awman__]

Hello,

I am trying to design queries that look up data from 7d or 30d back so that they act a bit smarter.

I was looking for a feature that would let me cache and refresh the data from long period of time so that they don't have to be evaluated at each run of the query.

The temporary solution is to save output of some query as function in the workspace and then use it to infer with the other data; but I think that solution doesn't achieve anything and it is hard to refresh the data. I am inserting it here so maybe you would better understand what I would like to have.

Is there such a feature that exists and I am not able to find it? Or am I approaching the problem thwrong and solution is there, but comes from another perspective?

[#2]

You shouldn't need to worry about caching as the KQL engine is quite efficient, especially when looking at time fields. No matter what, you would not be able to look for data further back than 14 days in an analytic rule.

[#3 · Accepted solution]

Two other options.

If it's a single query and you wish to retain data and re-use with the same KQL (know as a 'subquery') then look at https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/materializefunction

if you need to summarize data (a bit like what Microsoft does for the Usage table (which is an hourly aggregated summary of the Tables utilization and billing), you could look to do that via a logic app and a custom log which you query instead of the source Table.