[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-detail-573777-en":53,"doc-seo-573777-105":74},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":5,"data":54},{"doc_id":55,"user_id":56,"nickname":57,"user_avatar":58,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":60,"doc_content":61,"file_id":62,"file_url":63,"file_type":64,"file_size":65,"view_count":66,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":66,"language":67,"language_code":68,"site_id":69,"html_lang":68,"table_of_contents":70,"faqs":71,"seo_title":72,"seo_description":60,"update_tm":73,"read_time":9},573777,8796095461564,"Liam","https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","KQL Cheat Sheet - Basics of Kusto Query Language","KQL Cheat Sheet v0.3 provides a focused overview of the Kusto Query Language (KQL), emphasizing practical query patterns for the SecurityEvent table (abbreviated as T). It explains core operators and syntax such as where filtering, pipe-based transformations, project and project-away for column selection, extend for calculated fields, and count for aggregations. It also covers string handling, escaping rules, time filtering with ago() and between(), search across tables, and common comparison and regex matching techniques.","KQL Cheat Sheet v0 .3 [github.com/marcusbakker/KQL/blob/master/kql_cheat_sheet.pdf @Bakk3rM](github.com/marcusbakker/KQL/blob/master/kql_cheat_sheet.pdf @Bakk3rM)   \nThe purpose of this cheat sheet is to cover the basics of the Kusto Query Language (KQL) . Most of the queries from this cheat sheet will run on the SecurityEvent table accessible via [https://aka.ms/lademo](https://aka.ms/lademo. In the queries)[. In the queries](https://aka.ms/lademo. In the queries) below, the table SecurityEvent is abbreviated by T. Many of the KQL functions and operators below link back to the official KQL documentation.  \nThe example queries only have the purpose of explaining KQL and may stop providing results due to changes in the data on the Log Analytics demo portal.  \nGeneric  \nString search  \nA string literal with a backslash requires escaping by a backslash:  \n\"a string literal with a \\\\ needs to be escaped\"  \nThe same can be achieved using a verbatim string literal by putting the @ sign in front: @ \"a verbatim string literal with a \\ that does not need to be escaped\"  \nMore info on escaping string data types can be found here.  \nAdd comments to your query with a double forward slash:  \n// This is a comment  \nThe where operator and the pipe ( | ) delimiter are essential in writing KQL queries.  \nwhere is used to filter rows from a table. In this example we filter on events from a source, the table SecurityEvent, where the column Computer has\"[contosohotels.com](contosohotels.com)\", and count the number of results:  \nSecurityEvent | where Computer has \"[contosohotels.com](contosohotels.com)\" | count  \nThe pipe is used to separate data transformation operators. Such as: where Computer has \"[contosohotels.com](contosohotels.com)\". The result can be piped to a new operator. For example, to count the number of rows: | count  \n\n| Only include events from the last 24 hours using the ago () function: T | where TimeGenerated > ago (24h)\u003Cbr>For performance reasons always use time filters first in your query.\u003Cbr>The ago() function supports multiple types of timespans. More info can be found here. For example:\u003Cbr>• 1d\u003Cbr>• 10m\u003Cbr>• 30s\u003Cbr>1 day\u003Cbr>10 minutes\u003Cbr>30 seconds\u003Cbr>Include events that occurred between a specific timeframe: T | where TimeGenerated between (datetime(2022-08-01 00:00:00) .. datetime (2022-08-01 06:00:00)) |\n| --- |\n| Select and customize the columns from the resulting table of your query with the project operator.\u003Cbr>• Specify the columns to include:\u003Cbr>T | project TimeGenerated, EventID, Account, Computer, LogonType\u003Cbr>• Rename columns. In this example we renamed the column Account to UserName:\u003Cbr>T | project TimeGenerated, EventID, UserName = Account, Computer, LogonType\u003Cbr>• Remove columns with project-away:\u003Cbr>T | project-away EventSourceName, Task, Level |\n| Add calculated columns to the result using the extend operator: T | extend EventAge=now()-TimeGenerated |\n\nCount the number of records using the count operator: T | count  \n\n| Search across all tables and columns: search \"*KEYWORD*\"\u003Cbr>• Keep in mind that this is a performance-intensive operation. |\n| --- |\n| Search for a specific value: T | where ProcessName ==@\"C:\\Windows\\System32\\svchost.exe\" |\n| A not equal to match is done by adding an exclamation mark as prefix:\u003Cbr>• Equal to: ==\u003Cbr>• Not equal to: ! =\u003Cbr>This is also supported in a similar way for other string operators. |\n| A case insensitive match can be achieved using a tilde:\u003Cbr>• Case sensitive: ==\u003Cbr>• Case insensitive: =~\u003Cbr>• Case insensitive and not equal to: !~\u003Cbr>This is also supported in a similar way for other string operators. |\n| Match on values that contain a specific string:\u003Cbr>T | where CommandLine contains \"guest\"\u003Cbr>Because has is more performant, it’s advised to use has over contains when searching for full keywords. The following expression yields to true:\u003Cbr>• \"North America\" has \"america\"\u003Cbr>contains and has are case insensitive by default. A case sensitive match can be achieved by a","cbCaiqtlJKTEhIqv","https://ap.wps.com/l/cbCaiqtlJKTEhIqv","pdf",335240,2,"English","en",105,"# Introduction\n## Core query structure and operators\n## Time filtering and column shaping\n## Searching and string matching\n## Logical operators, let, and reusable expressions","[{\"question\":\"What are the essential operators for writing KQL queries in this cheat sheet?\",\"answer\":\"The cheat sheet highlights the where operator for filtering rows and the pipe (|) delimiter to separate data transformation operators.\"},{\"question\":\"How can results be limited to the last 24 hours?\",\"answer\":\"Use a time filter with ago(), for example: T | where TimeGenerated \\u003e ago(24h). The sheet advises applying time filters first for performance.\"},{\"question\":\"How does the cheat sheet recommend matching strings in KQL?\",\"answer\":\"It distinguishes equality operators (==, =~), substring operators (contains vs has), prefix/suffix matching (startswith/endswith), list matching with in, and regular expression matching with matches regex, including case-insensitive options and escaping rules.\"}]","KQL Cheat Sheet - Basics of Kusto Query Language | PDF",1791945915,{"code":4,"msg":75,"data":76},"ok",{"site_id":69,"language":68,"slug":77,"title":59,"keywords":78,"description":60,"schema_data":79,"social_meta":133,"head_meta":135,"extra_data":137,"updated_unix":138},"kql-cheat-sheet-basics-of-kusto-query-language","",{"@graph":80,"@context":132},[81,96,115],{"@type":82,"itemListElement":83},"BreadcrumbList",[84,88,90,93],{"item":85,"name":86,"@type":87,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":89,"name":10,"@type":87,"position":66},"https://docshare.wps.com/template/",{"item":91,"name":11,"@type":87,"position":92},"https://docshare.wps.com/template/presentations/",3,{"item":94,"name":59,"@type":87,"position":95},"https://docshare.wps.com/template/kql-cheat-sheet-basics-of-kusto-query-language/573777/",4,{"url":94,"name":59,"@type":97,"image":98,"author":103,"headline":59,"publisher":105,"fileFormat":108,"inLanguage":68,"description":60,"dateModified":109,"datePublished":109,"encodingFormat":108,"isAccessibleForFree":110,"interactionStatistic":111},"DigitalDocument",{"url":99,"@type":100,"width":101,"height":102},"https://docshare.wps.com/thumbnails/kql-cheat-sheet-basics-of-kusto-query-language/573777.png","ImageObject",442,249,{"name":57,"@type":104},"Person",{"url":85,"name":106,"@type":107},"DocShare","Organization","application/pdf","2026-10-14",true,{"@type":112,"interactionType":113,"userInteractionCount":66},"InteractionCounter",{"@type":114},"ViewAction",{"@type":116,"mainEntity":117},"FAQPage",[118,124,128],{"name":119,"@type":120,"acceptedAnswer":121},"What are the essential operators for writing KQL queries in this cheat sheet?","Question",{"text":122,"@type":123},"The cheat sheet highlights the where operator for filtering rows and the pipe (|) delimiter to separate data transformation operators.","Answer",{"name":125,"@type":120,"acceptedAnswer":126},"How can results be limited to the last 24 hours?",{"text":127,"@type":123},"Use a time filter with ago(), for example: T | where TimeGenerated > ago(24h). The sheet advises applying time filters first for performance.",{"name":129,"@type":120,"acceptedAnswer":130},"How does the cheat sheet recommend matching strings in KQL?",{"text":131,"@type":123},"It distinguishes equality operators (==, =~), substring operators (contains vs has), prefix/suffix matching (startswith/endswith), list matching with in, and regular expression matching with matches regex, including case-insensitive options and escaping rules.","https://schema.org",{"og:url":94,"og:type":134,"og:title":59,"og:site_name":106,"og:description":60},"article",{"robots":136,"canonical":94},"index,follow",{"doc_id":55,"site_id":69},1792015536]