Full series information: https://aka.ms/learnlive-202302FT

More info here: https://aka.ms/learnlive-202302FT-Ep16

Follow on Microsoft Learn:

- Session documentation: https://aka.ms/learnlive-20230620FT

In this session, learn how to write queries in Kusto Query Language (KQL) in the context of Azure Monitor and Microsoft Sentinel. We will cover best practices, design, how to create queries in the interface and leveraging scalar/aggregation functions and much more.


---------------------

Learning objectives

- Introduction to KQL
- Syntax and basic operations
- Advanced operations such as join and parse

---------------------

Chapters
--------
00:00 - Introduction
01:19 - Learning resources
01:49 - Learning objectives
04:32 - Getting started
04:59 - Navigating the interface
11:14 - Query writing tips and tricks
13:18 - Writing your first query
14:35 - Filtering and sorting
24:13 - Aggregation and scalar functions
37:33 - Rendering graphs
47:17 - Joining queries
1:01:05 - Parsing text
1:16:30 - Queries in Azure Resource Graph
1:27:38 - Wrap-up summary

---------------------

Presenters

Vanessa Bruwer
Senior Customer Engineer in FastTrack for Azure
Microsoft
- LinkedIn:   / vanessa-bruwer-293980105  

Saul Dolgin
Senior FastTrack for Azure Engineer
Microsoft
- LinkedIn:   / sdolgin  

Moderators

Nisha Mathew
Azure Customer Engineer
Microsoft
- LinkedIn:   / nisha-mathew-4a08981a7