Skip to main content

KQL Query Builder

The KQL Query Builder page is an interactive KQL workbench for data lake indexes: browse an index's columns, write a KQL query against it, run the query, and review past runs and results.

Menu path: Data Lake → KQL Query Builder · URL path: /dataLake/schemas/builder

This page was previously labelled Table Builder in the menu, and is still reached at /page-functionality/data-lake/table-builder.

KQL Query Builder page with the index list, KQL editor, and Query History table

Page Layout​

From top to bottom the page contains:

  • A header with the page title KQL Query Builder and the subtitle KQL Query.
  • A left INDEXES panel listing the queryable indexes — behavior, CloudTrail, default, and Office365 in this capture — each with an expand chevron.
  • On the right, a toolbar with the Run query button and a Set in query control (marked with a calendar icon), above the dark KQL editor. The editor holds the current query — here default | where timestamp > ago(24h) | take 100 — with line numbers and syntax highlighting.
  • Below, a Query History tab and a Results tab. Query History is selected when the page loads.

Indexes Panel​

Click an index name to select it and expand its schema in place, listing each column with its type:

Behavior index expanded in the INDEXES panel, listing its columns and types

The base columns shown for the demo indexes are timestamp (INT64), size (INT32), doc (BYTE_ARRAY), and labels (MAP).

Expanding another index does not collapse the first — each entry opens independently, so several indexes can show their columns at once. Here CloudTrail has been expanded after behavior, which stays open above it:

CloudTrail index expanded below the still-expanded behavior index in the INDEXES panel

The default and Office365 entries behave the same way, expanding to show their own column lists.

Query Toolbar and Editor​

The toolbar above the editor contains:

  • Run query — executes the KQL currently in the editor.
  • Set in query — a control with a calendar icon, associated with the query's time range. History entries whose range comes from the query itself (for example the ago(24h) filter in the sample query) show Set in query in their Search Range column.

Run query​

Click Run query to execute the editor's query. The page switches to the Results tab:

Results tab after running a query, showing the search range summary and No results found

The Results view shows a summary line with the search range, the total number of records searched, and the total bytes searched. When no records match — as in this demo run — the body reads No results found.

Query History​

The Query History tab lists previous query runs. Above the table, a Search box filters the list and the Refresh History button reloads it. The table columns are:

  • Time — when the query ran.
  • Execution Time — how long the run took, in milliseconds.
  • Search Range — the range source label (Set in query for these entries) with a Rerun Query button.
  • Status — a status chip, completed for each run shown.
  • KQL — the query text that was executed.

A footer bar reports the visible range (Showing 1 to 7 of 7 results in this capture) with a numbered page button between previous/next paging arrows.

Rerun Query​

Click Rerun Query on a history row to execute that entry's KQL again. The page switches to the Results tab, showing the same results view as Run query:

Results tab after rerunning a query from history, showing the search range summary and No results found

Every history row offers the same Rerun Query action for its own recorded query.