Does this Data Explorer Query builder consider the RBAC role needed to apply the configuration?

No — generating a Data Explorer Query configuration is independent of the role required to apply it. Apply the output with a principal that has the documented permissions for that service. For least-privilege scoping, Azure's built-in roles and the Privileged Identity Management 'just enough access' workflows give you a starting point.

Can I use this Data Explorer Query builder for Azure Government or sovereign clouds?

Most Data Explorer Query primitives behave the same across commercial, Government, and other sovereign Azure clouds, but the endpoints, available regions, and a handful of services differ. The output is portable in terms of resource shape; you must verify service availability and adjust endpoints when targeting a sovereign cloud.

Azure Data Explorer Query Builder

MonitoringAzure

Build ADX Kusto query configs with KQL queries for latency percentiles, anomaly detection, time series, and materialized views.

Azure Data Explorer (Kusto) Configuration

Build ADX Kusto query configs with KQL queries for latency percentiles, anomaly detection, time series analysis, and materialized views.

Required Fields

clusterNamedatabasequeriesqueries[0].namequeries[0].kql

{
  "clusterName": "adx-contoso-prod",
  "clusterUri": "https://adx-contoso-prod.eastus2.kusto.windows.net",
  "database": "TelemetryDB",
  "queries": [
    {
      "name": "RequestLatencyPercentiles",
      "description": "Calculate p50, p90, p95, p99 latencies by service over the last hour.",
      "kql": "HttpRequests\n| where Timestamp > ago(1h)\n| summarize\n    p50 = percentile(DurationMs, 50),\n    p90 = percentile(DurationMs, 90),\n    p95 = percentile(DurationMs, 95),\n    p99 = percentile(DurationMs, 99),\n    count()\n  by ServiceName, bin(Timestamp, 5m)\n| order by Timestamp desc, ServiceName asc",
      "resultFormat": "timechart"
    },
    {
      "name": "ErrorRateAnomaly",
      "description": "Detect anomalous error rate spikes using series decomposition.",
      "kql": "HttpRequests\n| where Timestamp > ago(24h)\n| summarize errorCount = countif(StatusCode >= 500), totalCount = count() by bin(Timestamp, 5m)\n| extend errorRate = todouble(errorCount) / totalCount * 100\n| make-series avgErrorRate = avg(errorRate) on Timestamp from ago(24h) to now() step 5m\n| extend (anomalies, score, baseline) = series_decompose_anomalies(avgErrorRate, 1.5)\n| mv-expand Timestamp to typeof(datetime), avgErrorRate to typeof(double), anomalies to typeof(int), score to typeof(double), baseline to typeof(double)\n| where anomalies != 0",
      "resultFormat": "table"
    },
    {
      "name": "TopSlowEndpoints",
      "description": "Find the slowest API endpoints by average response time.",
      "kql": "HttpRequests\n| where Timestamp > ago(1h)\n| where StatusCode < 500\n| summarize\n    avgDuration = avg(DurationMs),\n    maxDuration = max(DurationMs),\n    requestCount = count()\n  by RequestPath, Method\n| where requestCount > 10\n| top 20 by avgDuration desc",
      "resultFormat": "table"
    },
    {
      "name": "UserSessionFunnel",
      "description": "Analyze user session funnel from page view to purchase.",
      "kql": "let pageViews = AppEvents | where Name == 'PageView' | project SessionId, ViewTime = Timestamp;\nlet addToCart = AppEvents | where Name == 'AddToCart' | project SessionId, CartTime = Timestamp;\nlet purchases = AppEvents | where Name == 'Purchase' | project SessionId, PurchaseTime = Timestamp;\npageViews\n| join kind=leftouter addToCart on SessionId\n| join kind=leftouter purchases on SessionId\n| summarize\n    totalSessions = dcount(SessionId),\n    viewedProduct = dcountif(SessionId, isnotnull(ViewTime)),\n    addedToCart = dcountif(SessionId, isnotnull(CartTime)),\n    purchased = dcountif(SessionId, isnotnull(PurchaseTime))",
      "resultFormat": "table"
    }
  ],
  "tableSchema": {
    "HttpRequests": {
      "columns": [
        { "name": "Timestamp", "type": "datetime" },
        { "name": "ServiceName", "type": "string" },
        { "name": "RequestPath", "type": "string" },
        { "name": "Method", "type": "string" },
        { "name": "StatusCode", "type": "int" },
        { "name": "DurationMs", "type": "real" },
        { "name": "ClientIP", "type": "string" }
      ],
      "retentionDays": 365,
      "cacheDays": 31
    }
  },
  "materializedViews": [
    {
      "name": "HourlyErrorSummary",
      "sourceTable": "HttpRequests",
      "query": "HttpRequests | summarize errorCount = countif(StatusCode >= 500), totalCount = count() by ServiceName, bin(Timestamp, 1h)"
    }
  ]
}

Generated Output

Output will appear here...

What This Tool Does

Build ADX Kusto query configs with KQL queries for latency percentiles, anomaly detection, time series, and materialized views. This tool helps Azure engineers generate valid configurations quickly without consulting documentation, reducing errors and accelerating infrastructure deployment. All processing runs in your browser with no data sent to external servers.

Common Use Cases

1Producing a Data Explorer Query starting point for a new service that follows the Azure reference architecture rather than copy-paste from another team's repo.
2Drafting a Data Explorer Query change for an Azure Bicep or Terraform module before raising the pull request, so reviewers can see intent in plain text.
3Showing a security or compliance reviewer a proposed Data Explorer Query configuration without forcing them through the Azure portal.
4Pre-flighting a Data Explorer Query change against a change-management ticket so the implementation matches what was approved.

Common Questions

Does this Data Explorer Query builder consider the RBAC role needed to apply the configuration?: No — generating a Data Explorer Query configuration is independent of the role required to apply it. Apply the output with a principal that has the documented permissions for that service. For least-privilege scoping, Azure's built-in roles and the Privileged Identity Management 'just enough access' workflows give you a starting point.
Can I use this Data Explorer Query builder for Azure Government or sovereign clouds?: Most Data Explorer Query primitives behave the same across commercial, Government, and other sovereign Azure clouds, but the endpoints, available regions, and a handful of services differ. The output is portable in terms of resource shape; you must verify service availability and adjust endpoints when targeting a sovereign cloud.

Related Learning Guides

Cost Management Guide24 min read
Azure Monitor & Application Insights26 min read

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.