Azure Data Explorer

Run Query

Run a Kusto Query Language (KQL) query against an Azure Data Explorer database and return the primary result table.

List Databases

List the databases on an Azure Data Explorer cluster that the service principal can access.

List Tables

List the tables in an Azure Data Explorer database, with their folder and docstring.

Show Table Schema

Read the column schema of an Azure Data Explorer table in CSL form (e.g., "Timestamp:datetime,Level:string"). Use this before writing a KQL query against an unfamiliar table.

Show Database Schema

Read the full schema of an Azure Data Explorer database as a flat list of every table and column, so an agent can discover the data model in one call.

Show Table Details

Read size, row count, hot-cache footprint, and effective policies for a table — or for every table in the database when no table is given. Use it to see how much data a table actually holds before querying it.

List Functions

List the stored functions in an Azure Data Explorer database, with their parameters and bodies, so an agent can reuse existing logic instead of rewriting it.

Ingest Rows Inline

Push rows directly into an Azure Data Explorer table with .ingest inline. Data is parsed as CSV against the table schema unless an ingestion property says otherwise. Intended for small batches — use queued or streaming ingestion for production volumes.

Ingest From Query

Materialize the result of a KQL query into a table with .set, .append, .set-or-append, or .set-or-replace. Use this to build rollup or summary tables instead of pushing rows from a workflow. Kusto matches the query result to the target table by column type and position, NOT by column name, so project the columns in exactly the table's order or the data lands in the wrong columns.

Create Table

Create a table in an Azure Data Explorer database from a CSL column schema. Succeeds without changing anything if a table of the same name already exists.

Drop Table

Drop a table from an Azure Data Explorer database. This permanently deletes the table and its data, and returns the tables that remain.

Show Ingestion Failures

List ingestion failures recorded for a database, with the failing table, error code, root cause detail, and whether the failure is permanent or transient. Failures are retained for 14 days.

Show Operations

Check the state of administrative operations on a cluster, such as an async ingestion. Given an operation ID it returns that operation latest update; with no ID it returns the operations from the last two weeks.

Management Command (advanced)

Run an Azure Data Explorer management command (a control command starting with ".") such as .show, .create, .alter, or .drop. Write commands change cluster state permanently; use the Query operation for reads.