Azure Data Explorer

Azure Data Explorer queries telemetry, logs, metrics, and other structured data. Use it in Sim to inspect the database schema, run queries, ingest rows, and execute management commands.

Write queries with KQL (Kusto Query Language), a pipeline language that reads left to right. Start with a table, then pipe the rows through operators:

Code

StormEvents
| where StartTime > ago(7d) and State == "FLORIDA"
| summarize Events = count() by EventType
| top 10 by Events

Azure Data Explorer also has a second command family: management commands, which all start with a dot (.show tables, .create table, .ingest inline). Queries read data; management commands inspect and change the cluster itself.

In Sim, this integration gives your agents both halves:

Ask questions of your telemetry — turn a plain-English question into KQL, run it, and answer with real numbers instead of a guess
Discover the data model first — list databases, tables, and stored functions, read a table's schema, and check its size and row count, so a generated query references columns that actually exist and you know what it will scan
Push rows in — send small batches straight into a table, or materialize a query result into a rollup table with .set-or-append
Manage tables — create a table from a column schema, or drop one you no longer need
Debug the pipeline — list ingestion failures with their error codes and root causes, and check the state of a long-running operation
Run any management command — the escape hatch for policies, mappings, and anything else on the control plane

Authentication uses a Microsoft Entra service principal (an app registration with a tenant ID, client ID, and client secret) rather than an interactive sign-in, so scheduled and unattended workflows keep working without anyone logging in. Grant that principal access to the database with .add database <DATABASE> viewers ('aadapp=<clientId>;<tenantId>') — use viewers for read-only agents, and ingestors or users only when a workflow needs to write.

A few things worth knowing before you build:

Enable Read-only on the Run Query operation whenever an agent writes its own KQL. It sends the x-ms-readonly header, and the cluster then refuses anything that would change data — a safeguard when generated KQL must only read data.
Results are capped at 10,000 rows. Every result reports rowCount, totalRowCount, and truncated, so a query that returned more than the cap says so rather than quietly looking complete. Aggregate with summarize or bound the query with take instead of pulling raw rows.
Ingest Rows Inline is for small batches. It is ideal for tens or hundreds of rows from a workflow run. For continuous or high-volume loading, use Azure Data Explorer's queued or streaming ingestion instead.
Ingest From Query defaults to set-or-append, which adds to an existing table. set-or-replace discards everything already in the target table — pick it only when you mean to rebuild the rollup from scratch. For a large backfill, turn on the background option and poll Show Operations with the operation ID it returns.
Ingest From Query matches columns by position, not by name. Kusto aligns the query result to the target table on column type and order, so a query that projects the right columns in the wrong order ingests data into the wrong columns without erroring. End the query with an explicit project in the table's column order, and confirm with Show Table Schema first.
Drop Table makes the table unavailable to queries. Recovery depends on the retention policy. A database admin can use .undo drop table only while the underlying data remains recoverable. Use viewers for workflows that only need to read.

Use the block

Run Kusto Query Language queries against Azure Data Explorer and Fabric Eventhouse clusters, discover databases, tables, and schemas, push small batches of rows inline, and run management commands. Authenticates with a Microsoft Entra service principal using client credentials, so no interactive sign-in is needed.

Actions

Azure Data Explorer Query

Run a Kusto Query Language (KQL) query against an Azure Data Explorer database and return the primary result table.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`database`	string	Yes	Database to run the query against
`query`	string	Yes	KQL query text (e.g., StormEvents \| where State == "FLORIDA" \| summarize count() by EventType)
`properties`	json	No	Kusto request properties object, e.g. {"Options":{"servertimeout":"00:04:00","queryconsistency":"strongconsistency"}}
`readOnly`	boolean	No	Send x-ms-readonly so the cluster rejects any request that would change data

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true

Azure Data Explorer Management Command

Run an Azure Data Explorer management command (a control command starting with ".") such as .show, .create, .alter, or .drop. Write commands can change data or configuration; use the Query operation for reads.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`command`	string	Yes	Management command text, starting with "." (e.g., .show table Events details)
`database`	string	No	Database context for the command. Required for all commands except cluster-level ones such as .show databases

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true

Azure Data Explorer List Databases

List the databases on an Azure Data Explorer cluster that the service principal can access.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true
`databases`	array	Database names, read from the DatabaseName column

Azure Data Explorer List Tables

List the tables in an Azure Data Explorer database, with their folder and docstring.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`database`	string	Yes	Database whose tables should be listed

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true
`tables`	array	Table names, read from the TableName column

Azure Data Explorer Show Table Schema

Read the column schema of an Azure Data Explorer table in CSL form (e.g., "Timestamp:datetime,Level:string"). Use this before writing a KQL query against an unfamiliar table.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`database`	string	Yes	Database containing the table
`table`	string	Yes	Table whose schema should be read

Output

Parameter	Type	Description
`tableName`	string	Name of the table
`schema`	string	Comma-separated CSL column schema (name:type)
`databaseName`	string	The table's database
`folder`	string	The table's folder
`docString`	string	The table's docstring

Azure Data Explorer Show Database Schema

Read the full schema of an Azure Data Explorer database as a flat list of every table and column, so an agent can discover the data model in one call.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`database`	string	Yes	Database whose schema should be read

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true

Azure Data Explorer Show Table Details

Read size, row count, hot-cache footprint, and effective policies for a table — or for every table in the database when no table is given. Use it to see how much data a table actually holds before querying it.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`database`	string	Yes	Database to read table details from
`table`	string	No	Table to describe. Omit to describe every table in the database

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true

Azure Data Explorer List Functions

List the stored functions in an Azure Data Explorer database, with their parameters and bodies, so an agent can reuse existing logic instead of rewriting it.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`database`	string	Yes	Database whose stored functions should be listed

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true
`functions`	array	Stored function names, read from the Name column

Azure Data Explorer Ingest Inline

Push rows directly into an Azure Data Explorer table with .ingest inline. Data is parsed as CSV against the table schema unless an ingestion property says otherwise. Intended for small batches — use queued or streaming ingestion for production volumes.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`database`	string	Yes	Database containing the target table
`table`	string	Yes	Table to ingest into. Its schema is the assumed schema for the data
`data`	string	Yes	Rows to ingest, one record per line, parsed as CSV by default (e.g., "Shoes,1000\nWide Shoes,50")
`ingestionProperties`	string	No	Ingestion properties clause contents, e.g. format="json", ingestionMappingReference="mymapping"

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true
`extentIds`	array	Extent IDs created by the ingestion — one per data shard. A single empty or zero-valued ID means no data shard was generated

Azure Data Explorer Ingest From Query

Materialize the result of a KQL query into a table with .set, .append, .set-or-append, or .set-or-replace. Use this to build rollup or summary tables instead of pushing rows from a workflow. Kusto matches the query result to the target table by column type and position, NOT by column name, so project the columns in exactly the table's order or the data lands in the wrong columns.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`database`	string	Yes	Database containing the target table
`table`	string	Yes	Table to ingest the query result into
`mode`	string	No	set (create, fail if it exists), append (add to an existing table), set-or-append (default), or set-or-replace (replace all data)
`sourceQuery`	string	Yes	KQL query whose result becomes the ingested data (e.g., LogsTable \| where Level == "Error" \| where Timestamp > ago(1h)). Project the columns in the target table's order — matching is positional, not by name
`async`	boolean	No	Return immediately with an OperationId and keep ingesting in the background. Check progress with Show Operations
`ingestionProperties`	string	No	Optional ingestion properties clause contents, e.g. distributed=true, tags='["daily"]'

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true

Azure Data Explorer Create Table

Create a table in an Azure Data Explorer database from a CSL column schema. Succeeds without changing anything if a table of the same name already exists.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`database`	string	Yes	Database to create the table in
`table`	string	Yes	Name of the table to create
`columnSchema`	string	Yes	Comma-separated CSL column schema (e.g., Timestamp:datetime, Level:string, Count:long)
`tableProperties`	string	No	Optional table properties clause contents, e.g. docstring="Raw logs", folder="Ingest"

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true

Azure Data Explorer Drop Table

Drop a table from an Azure Data Explorer database. The table becomes unavailable to queries; data recovery depends on the retention policy. Returns the tables that remain.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`database`	string	Yes	Database containing the table
`table`	string	Yes	Name of the table to drop
`ifExists`	boolean	No	Succeed instead of failing when the table does not exist

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true
`tables`	array	Tables remaining in the database, read from the TableName column

Azure Data Explorer Show Ingestion Failures

List ingestion failures recorded for a database, with the failing table, error code, root cause detail, and whether the failure is permanent or transient. Failures are retained for 14 days.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`database`	string	Yes	Database whose ingestion failures should be listed
`operationId`	string	No	Limit results to a single ingestion operation ID

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true

Azure Data Explorer Show Operations

Check the state of administrative operations on a cluster, such as an async ingestion. Given an operation ID it returns that operation latest update; with no ID it returns the operations from the last two weeks.

Inputs and outputs

Input

Parameter	Type	Required	Description
`clusterUri`	string	Yes	Cluster URI (e.g., https://mycluster.eastus.kusto.windows.net)
`tenantId`	string	Yes	Microsoft Entra tenant ID hosting the service principal
`clientId`	string	Yes	Microsoft Entra application (client) ID
`clientSecret`	string	Yes	Microsoft Entra application client secret
`resource`	string	No	Token audience override. Defaults to the cluster URI itself
`database`	string	No	Database context for the command
`operationId`	string	No	Operation ID to check, e.g. the ID returned by an async ingestion

Output

Parameter	Type	Description
`tableName`	string	Name Kusto assigned to the returned result table
`columns`	array	Column metadata for the result table
↳ `name`	string	Column name
↳ `type`	string	Kusto scalar type
↳ `dataType`	string	Approximate .NET type
`rows`	array	Result rows as positional arrays matching the columns order
`records`	array	Result rows keyed by column name
`rowCount`	number	Rows carried in this result, after the row cap
`totalRowCount`	number	Rows Kusto returned, before the row cap was applied
`truncated`	boolean	Whether rows were dropped to stay within the row cap — narrow the query if true