Query and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis. WHEN: KQL queries, Kusto database queries, Azure Data Explorer, ADX clusters, log analytics, time series data, IoT telemetry, anomaly detection.
SkillScore77Maintained
Automatic
◆Data Analyst pack
Last verified 8/3/2026
What it changes
Passed 17 of 22 test cases with the skill, and 14 of 22 without it.
Without skill64%
With skill77%
Checks it passed that the model alone missed
Formats the endpoint URL targeting the cluster's v1 rest query endpoint.
States that the '.kusto.windows.net' domain suffix must be omitted from the cluster parameter.
States that Azure SQL Database T-SQL execution is outside the scope of Azure Data Explorer tools.
3 fixed14 passed either way5 still failing0 broke
Pass-rate lift
+14 pp
Tokens
+133%
Agent turns
0%
Response time
-26%
Model gemini-3.6-flashMeasured 8/3/2026v117 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
The primary Azure Data Explorer tool timed out after 60 seconds on a complex query against cluster 'fintech' and database 'transactions'. I need to execute the query `Transactions | take 50` using the Azure CLI fallback `az rest` command. What is the required HTTP method and endpoint URL structure?
What was checked, without and with the skill
Checked
Without skill
With skill
Uses the POST HTTP method for the az rest command.
Passed
Passed
Formats the endpoint URL targeting the cluster's v1 rest query endpoint.
Missed
Passed
case-08 · gemini-3.6-flash · 8/3/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md222 linessingle file
Azure Data Explorer (Kusto) Query & Analytics
Execute KQL queries and manage Azure Data Explorer resources for fast, scalable big data analytics on log, telemetry, and time series data.
Skill Activation Triggers
Use this skill immediately when the user asks to:
"Query my Kusto database for [data pattern]"
"Show me events in the last hour from Azure Data Explorer"
"Analyze logs in my ADX cluster"
"Run a KQL query on [database]"
"What tables are in my Kusto database?"
"Show me the schema for [table]"
"List my Azure Data Explorer clusters"
"Aggregate telemetry data by [dimension]"
"Create a time series chart from my logs"
Key Indicators:
Mentions "Kusto", "Azure Data Explorer", "ADX", or "KQL"
Log analytics or telemetry analysis requests
Time series data exploration
IoT data analysis queries
SIEM or security analytics tasks
Requests for data aggregation on large datasets
Performance monitoring or APM queries
Overview
This skill enables querying and managing Azure Data Explorer (Kusto), a fast and highly scalable data exploration service optimized for log and telemetry data. Azure Data Explorer provides sub-second query performance on billions of records using the Kusto Query Language (KQL).
Key capabilities:
Query Execution: Run KQL queries against massive datasets
Schema Exploration: Discover tables, columns, and data types
Resource Management: List clusters and databases
Analytics: Aggregations, time series, anomaly detection, machine learning
Core Workflow
Discover Resources: List available clusters and databases in subscription
Explore Schema: Retrieve table structures to understand data model