take operator can be a useful debugging tool, or a tool to use as you develop your Kusto queries. It will grab a random number of rows from the incoming dataset and return them.
The samples in this post will be run inside the LogAnalytics demo site found at https://aka.ms/LADemo. This demo site has been provided by Microsoft and can be used to learn the Kusto Query Language at no cost to you.
If you’ve not read my introductory post in this series, I’d advise you to do so now. It describes the user interface in detail. You’ll find it at https://arcanecode.com/2022/04/11/fun-with-kql-the-kusto-query-language/.
Note that my output may not look exactly like yours when you run the sample queries for several reasons. First, Microsoft only keeps a few days of demo data, which are constantly updated, so the dates and sample data won’t match the screen shots.
Second, I’ll be using the column tool (discussed in the introductory post) to limit the output to just the columns needed to demonstrate the query. Finally, Microsoft may make changes to both the user interface and the data structures between the time I write this and when you read it.
take operator is incredibly simple to use. Just take a dataset, then pipe it into the
take operator and indicate how many rows you want.
In this example we took the
Perf table, and piped the dataset it generated into the
take operator. We indicated we wanted to get
10 rows, which it did as you can see.
It is important to understand that
take grabs these rows at random. Further, there is no consistency between each execution of
take. You are likely to get a different set of rows with each execution. Let me run the exact same query again, so you can see the different data being returned.
As you can see, the resulting data is completely different, even though I ran the exact same query within seconds after the first execution.
So why use the
take operator? Well it is an incredibly useful tool for developing your query. As you add each new operator to your pipe, you can add a
take at the end to spot check your results. Because
take executes very quickly, you can rapidly find out if your query is working, or maybe you did something that returned zero rows.
Building Queries Step by Step
Lets look at an example of using take when building a query. We’ll reuse a query from our post on the
We took our
Perf table and piped it into the
where operator to limit the data to the last hour. We then pipe it into
take to verify the rows are indeed from the last hour. Since they are, we can now continue our query development.
For the next step in our query, we want to limit the result set to only include rows where the CounterName column contains the text
As you can see, I added an
and clause to our
where operator to limit based on the CounterName. That was piped into our
take so we could verify the results.
So far so good. Now lets add another condition! We’ll pipe the existing query into a new
where clause to only return data when the CounterValue is greater than zero. We’ll then pipe that into our
take so we can spot check the results.
There we go, the output shows no rows with a zero CounterValue, giving us some assurance things are working correctly.
From here we can keep adding more and more steps to our query, using
take each time to spot check the results. The
take operator winds up being an extremely useful tool, which I use frequently when developing queries.
Note too that for this example I changed the number of rows passed into the
take operator to 33. I just wanted to illustrate this can be any value. Early in my development I set it to a low number, perhaps 100, but toward the end will bump it up to 1000, or even higher, so I can better verify my results.
You may see references to the
limit operator. Be aware that
limit is nothing more than a synonym for
There is no difference between
take. They behave identically. In some query languages the keyword
limit is used to perform the same task, so to make learning KQL easier the creators included the ability to use
In this post we covered one of the easiest to use, but extremely useful operators in KQL:
take. As you begin your life as a Kusto query developer, I’m sure you’ll find
take as useful as I do.
The demos in this series of blog posts were inspired by my Pluralsight courses Kusto Query Language (KQL) from Scratch and Introduction to the Azure Data Migration Service, two of the many courses I have on Pluralsight. All of my courses are linked on my About Me page.
If you don’t have a Pluralsight subscription, just go to my list of courses on Pluralsight . At the top is a Try For Free button you can use to get a free 10 day subscription to Pluralsight, with which you can watch my courses, or any other course on the site.