KQL Fundamentals – Take/Limit
Level: Beginner | Reading time: 5 minutes
Let’s continue our series on KQL with a focus on Cyber Security. Let’s talk today about how to use the Take/Limit operators. Other posts can be seen in our KQL category.
The Take or Limit (which is nothing more than an alias for Take and has the same effect), is very simple and we don’t need a very long post to cover it.
It is for you to have a random sample of how many lines you want to have. This is useful when we want to get an idea of whether we are working with the data we expect, as in the example below:
StormEvents
| take 5
| project StartTime, EndTime, EventType, State, EventNarrative
In the example, we want to return 5 random results from the StormEvents table. Note that the take operator shows table rows without a specific order, so different results may appear at each execution.
The take can be useful in combination with other operators, such as where for example.
StormEvents
| where TimeGenerated >= ago(1h)
| take 5
Note that I used ago in the example above, so I’ll show it in some next article! 🙂
Summary
In this KQL post, we saw how to use the take/limit operators.
Thank you!
