KQL basics: where, project, extend, summarize, count, bin, ago(), order by, take, render

Kusto Query Language (KQL) is the read-only query language used in Microsoft Sentinel, Azure Monitor Log Analytics and Defender XDR advanced hunting. A query starts with a table name and passes rows through a pipeline of operators separated by the pipe character. Each operator takes the rows from the previous one and returns a new set. Reading top to bottom is reading the order of processing, which makes KQL easy to build one step at a time. Because it cannot change data, you can experiment freely.