Edit

Share via


Create a KQL queryset

In this article, you learn how to create a new KQL queryset. The KQL queryset is the item used to run queries, view, and customize query results on data from different data sources, such as Eventhouse, KQL database, and more.

Prerequisites

Create a KQL queryset

A new KQL queryset can be associated with the workspace you're using when you create it, or you can change the workspace context when you create it.

  1. Go to the desired workspace.

  2. Select +New item.

    Screenshot of adding a new KQL queryset from workspace homepage.

  3. Select KQL Queryset. Use the search bar to filter by item type.

    Screenshot of adding a new KQL queryset in the New item box.

  4. In the New KQL Queryset window, enter a unique name. You can use alphanumeric characters, underscores, periods, and hyphens. Special characters aren't supported.

    Note

    You can create multiple KQL Querysets in a single workspace.

  5. (Optional) Set the Location for the new queryset. By default, the location is set to the current workspace.

    Screenshot of new KQL queryset window with name and location fields highlighted.

    To change the location, expand the drop-down to select a different workspace, or use the expand option to see all workspaces that you have access to. You can also create a new folder in the selected workspace.

    Screenshot of new KQL queryset window the list of workspaces to select.

  6. For workspaces with a task flow, you can Assign to task. By default, a new queryset is assigned to the Track data task. You can change the task assignment by expanding the drop-down and selecting a different step in the flow.

  7. Select Create.

  8. In the Get started... window, add a data source to the KQL Queryset. You can add a data source from the following options:

    Select one of the options to add a data source to the KQL Queryset. For connection details for each option, see Select a data source.

    • Eventhouse / KQL Database: See the list of databases in the OneLake catalog.
    • Azure Data Explorer: Connect to Azure Data Explorer (ADX) clusters to query data.
    • Azure Application Insights: Run direct or cross-service queries.
    • Azure Log Analytics: Connect to Log Analytics workspaces to query direct or cross-service data.

    Screenshot of get started page with add data sources highlighted.

Open an existing KQL queryset

  1. To access an existing KQL queryset, go to your workspace.

  2. Optionally, you can reduce the number of items displayed by filtering on the item type. Select Filter > KQL Queryset.

    Screenshot of filtering types of items in workspace.

  3. Select the KQL queryset from the list of items that appear in the workspace.

Next step