New Blog Post | Must Learn KQL Part 16: The Order/Sort and Top Operators

%3CLINGO-SUB%20id%3D%22lingo-sub-3073228%22%20slang%3D%22en-US%22%3ENew%20Blog%20Post%20%7C%20Must%20Learn%20KQL%20Part%2016%3A%20The%20Order%2FSort%20and%20Top%20Operators%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3073228%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22AshleyMartin_0-1643233821437.png%22%20style%3D%22width%3A%20672px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F342788i2D5115CCD6FDC487%2Fimage-dimensions%2F672x353%3Fv%3Dv2%22%20width%3D%22672%22%20height%3D%22353%22%20role%3D%22button%22%20title%3D%22AshleyMartin_0-1643233821437.png%22%20alt%3D%22AshleyMartin_0-1643233821437.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fazurecloudai.blog%2F2022%2F01%2F26%2Fmust-learn-kql-part-16-the-order-sort-and-top-operators%2F%3FWT.mc_id%3Dm365-0000-rotrent%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3EMust%20Learn%20KQL%20Part%2016%3A%20The%20Order%2FSort%20and%20Top%20Operators%20%E2%80%93%20Azure%20Cloud%20%26amp%3B%20AI%20Domain%20Blog%20(azurecloudai.blog)%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EIn%20this%20last%20part%2Fchapter%20of%20the%20series-within-the-series%20for%20data%20view%20manipulation%2C%20I%E2%80%99m%20going%20to%20combine%20a%20couple%20operator%20types.%20Looking%20at%20the%20title%20of%20this%20part%2Fchapter%2C%20it%20may%20seem%20that%20I%E2%80%99m%20focused%20on%20three%20operators%20(order%2C%20sort%2C%20and%20top)%2C%20but%20really%20%E2%80%93%26nbsp%3B%3C%2FSPAN%3E%3CEM%3Elike%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fcda.ms%2F3s7%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%20nofollow%22%3ELimit%2FTake%20operators%20from%20Part%209%3C%2FA%3E%3C%2FEM%3E%3CSPAN%3E%26nbsp%3B%E2%80%93%20Order%20and%20Sort%20provide%20functionally%20no%20difference.%20This%20is%20one%20of%20those%20situations%2C%20again%2C%20where%20it%20becomes%20personal%20preference%20which%20one%20to%20use.%20In%20fact%2C%20when%20you%20read%20through%20the%20KQL%20reference%20doc%20it%20will%20tell%20you%20that%E2%80%A6%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-3073228%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECloud%20Security%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMicrosoft%20Sentinel%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft

AshleyMartin_0-1643233821437.png

Must Learn KQL Part 16: The Order/Sort and Top Operators – Azure Cloud & AI Domain Blog (azureclouda...

In this last part/chapter of the series-within-the-series for data view manipulation, I’m going to combine a couple operator types. Looking at the title of this part/chapter, it may seem that I’m focused on three operators (order, sort, and top), but really – like the Limit/Take operators from Part 9 – Order and Sort provide functionally no difference. This is one of those situations, again, where it becomes personal preference which one to use. In fact, when you read through the KQL reference doc it will tell you that…

0 Replies