CODEWITHSUNDEEP
azure-data-explorerkql
Michal
Michal

Reputation: 11

Where condition in KQL

I am looking for help with Kusto query:

| where test == "Jump" and Time > 2
| where test == "Run" and Time > 20
| where test == "Stand" and Time > 5

It is interesting because I am not getting error message, however I should get results... At least I get results when I run where commands separately, but when I execute query as one, no results...any idea why?

Test    Time

Jump     10
Run      13
Stand    15
Jump     5
Run      15
Stand    4

Upvotes: 1

Views: 3890

Answers (1)

Yoni L.
Yoni L.

Reputation: 25955

The query you included is the equivalent of:

...
| where test == "Jump" and Time > 2
    and test == "Run" and Time > 20
    and test == "Stand" and Time > 5
| ...

In the data set you've provided, the intersection (and) of all of the conditions you included is empty, therefore no records are returned:

  • | where test == "Jump" and Time > 2: 2 matching records are (Jump, 10), (Jump, 5)
  • | where test == "Run" and Time > 20: there are no matching records.
  • | where test == "Stand" and Time > 5: 1 matching record is (Stand, 15)

I think your intention was to use the or keyword, e.g.:

...
| where (test == "Jump" and Time > 2)
     or (test == "Run" and Time > 20)
     or (test == "Stand" and Time > 5)
| ...

Otherwise, you'll need to clarify what the expected output is.

Upvotes: 5

Related Questions