Loading...
Area: Episerver Profile Store
Applies to versions: 1.3.0 and higher

Using Kusto Query Language

Recommendations [hide]

This topic introduces the Kusto Query Language (KQL), used to query events data.

In this topic

What is KQL?

Kusto Query Language (KQL) is a language to query structured, semi-structured, and unstructured data. See Microsoft Documentation for a tutorial and reference.

Using KQL

In Episerver Profile Store, KQL is used to query and analyze track events data. See Track events and Filter definition articles to understand the basics of KQL in both querying track events and working with filter definition, and some examples of KQL in Event Filter definition.

Limitations

  • KQL is used for read-only requests to process data and return results. Create, update, or delete operations are not supported.
  • When running KQL, there is a query timeout setting, so a query that is too complicated can return a bad request.
  • Profile API limits query based on resource usage.
  • When using preview endpoint to test KQL Query in an Event filter definition, the result is limited to 1000 results.

Best Practices

  • Follow Query best practice from Microsoft.
  • Limit the usage of queries that performs a table scan. For example, Events | sample 1  scans the whole table and retrieves one random record; thus, the query will run very slowly. For this case, use Events | take 1, which also returns one random record but without scanning the whole table, so the performance is significantly improved.
  • Simplify the query as much as possible. For example:

    Instead of:

    Events | where DeviceId == "device1" | where DeviceId == "device2" | where DeviceId == "device3"

    The following code returns the same result but is more concise:

    Events | where DeviceId in ("device1", "device2", "device3")
  • Query on the latest data, if possible. Querying older data would take a much longer time.
Do you find this information helpful? Please log in to provide feedback.

Last updated: Oct 31, 2019

Recommendations [hide]