MustLearnKQL: a Kusto Query Language course kept in a repository

A course that happens to be a repository

The rod-trent/MustLearnKQL repository contains the code, queries, and eBook included as part of the MustLearnKQL series, which the README describes as a continuing effort to discuss and educate about the power and simplicity of the Kusto Query Language.

The framing is unusual, and it explains the structure. A course delivered as blog posts would normally leave the code in the posts. Here the posts link to a repository that holds the example queries as files, one directory per part, plus the datasets those queries run against, so a reader can open a lesson and copy the query rather than retype it from a screenshot.

The series started in November 2021. Part 1, Tools and Resources, was posted on November 17, 2021, and Part 2 followed the next day. The titles themselves are a syllabus for the language. Part 2 is Just Above Sea Level, Part 3 is Workflow, Part 4 is Search for Fun and Profit, and Part 5 is Turn Search into Workflow. Then Part 6 is Interface Intimacy, Part 7 is Schema Talk, and from Part 8 onwards the lessons are one operator each: The Where Operator, The Limit and Take Operators, The Count Operator, The Summarize Operator, The Render Operator with Bin and Time, The Extend Operator, The Project Operator, The Distinct Operator, The Order/Sort and Top Operators, The Let Statement, The Union Operator, and The Join Operator.

That progression is the teaching method. Each post takes one operator, gives it a full post, and puts a runnable query with it. The last push to the repository was on 2026-10-09, and the licence is MIT.

The example files, and what the naming tells you

The Examples/ directory is the practical heart of the repository, and the file names map directly onto the posts. The pattern is Part followed by the number and a short description of what the query does.

For Part 10, which is the count operator, there are Part10CountTable.txt, Part10SuccesfulLogon.txt, and Part10UnsuccessfulLogons.txt, so the lesson ships three queries, one that counts a table and two that count a logon pattern and its failure. Part 11, the summarize operator, has Part11Summarize.txt alongside Part11ArgMaxCountif.txt, Part11ArgMaxAzureDiags.txt, and Part11ArgMaxSecurityEvent.txt, which is the author using the same operator three different ways.

Part 12, the render operator, is the one with the most variants. There is Part12DatainaBarChart.txt, Part12JusttheData.txt, and three files marked ExtraCredit: Part12ExtraCreditFreeSpace.txt, Part12ExtraCreditIPAddresses.txt, and Part12ExtraCreditOooPretty.txt. The extra credit pattern is a teaching device. The main query is the one to read, and the extras are variations that reward a reader who wants to push further.

Part 13, the extend operator, has Part13ComputerNameLength.txt, Part13Contest.txt, Part13FreeDiskSpace.txt, and Part13MakingDataUp.txt. The last one is the interesting title, because a query that makes data up is a query that does not read from a table at all, which is a useful thing to learn in isolation.

Part 14, the project operator, has Part14ProjectOperator.txt and Part14FreeMGwithoutExtend.txt, where the second is the same result achieved without the previous part's operator. Part 15, distinct, has Part15Distinct.txt, Part15DistinctComputer.txt, and Part15DistinctComputerCount.txt. Part 16, order and sort, has Part16SortandOrder.txt, Part16SortandOrderNoNulls.txt, Part16SortandOrderSortNulls.txt, and Part16TopOperator.txt.

So each part ships a core query plus variations, and the variations are named for the edge case they handle. Nulls get their own file, because null ordering is exactly where a sort behaves differently from what a reader expects, and the lesson that comes after teaches it explicitly rather than leaving it to be discovered.

The datasets, and the other directories

A course about a query language is only half useful without data to run the queries against, and the repository has a Datasets/ directory for that. The example queries reference tables with specific shapes, and those shapes come from the sample data in that directory, which is what lets a reader run every query in the series and get the output the post shows.

The other top level directories cover the different ways the material is delivered. Book_Version/ holds the eBook, which the README says is updated whenever changes are made or new parts of the series are released, and there is a paperback version available on Amazon with the note that as with the merchandise, all profit goes directly to St. Jude. Advanced_KQL/ holds the advanced material, which the README points to as The KQL Mysteries series. Workshop/ is the workshop, App/ is the app, Docs/ is documentation, and Series_Images/ and Wallpaper/ hold the artwork.

There is also a WhatsNew.md, linked from the README as the page to monitor for what is new and exciting, which is a sensible way to keep readers of a long-running series aware that it is still moving.

The App entry is described with a level of enthusiasm that suggests it is a significant piece of work, with its own directory and a link to the details. A mobile app for a query language is an interesting idea, since the natural place to run KQL is a log analytics workspace rather than a phone, but a companion app for running saved queries and looking at results is a plausible reading.

The Docs/ directory and the Docs link in the contributing sense suggest that the written material lives in the repository as files rather than only on the hosting platform.

The multi-format distribution, and where the money goes

The README is a list of everything that has grown out of the series, and reading it tells you something about how a technical blog becomes a business.

There is the blog itself, published on a Substack, with a shortlink at aka.ms/MustLearnKQL to return to the series. There is a YouTube channel where a colleague, David Hall, produces follow-along video editions, and the table of contents shows a video link against most of the parts, though not the earliest ones, which were written before the video work started.

There is the eBook, updated whenever changes are made, and the paperback from Amazon, and an advanced book, the Advanced Must Learn KQL book, with its own link. And there is a merch store with a coffee mug, where all proceeds go to St. Jude Children's Research Hospital, and the same note appears against the paperback, that all profit goes directly to St. Jude.

That is the unusual part of this project. The code, the queries, the datasets, and the book content are all MIT licensed and free, and the monetisation is a mug and a donation to a children's hospital, with a paperback that also donates. The repo is therefore usable as a reference without any of the commercial context being entangled with the technical material.

The code of conduct and privacy policy files at the top level complete the picture of a project that has grown into a small organisation rather than a single repository.

Editorial conclusion

Adopt the MustLearnKQL examples as a working reference if you write KQL against Log Analytics or Defender and want runnable queries rather than documentation prose. Do not expect a library or a tool, because this repository is a course with sample data attached. Verify first that the datasets in the Datasets directory match the schema of the tables you query, since the example queries assume the sample shapes.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. README
4. rod-trent/MustLearnKQL on GitHub