[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FD42HF6EVAEAT0VNJ1BCP5":3,"skill-same:01M6FD42HF6EVAEAT0VNJ1BCP5":52},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":25,"linkOnly":26,"markdownContent":27,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":32,"repositoryHtmlUrl":33,"repositoryHomepageUrl":34,"ownerHtmlUrl":35,"ownerBlogUrl":6,"ownerDescription":36,"updatedAt":37,"install":38,"resources":51},"01M6FD42HF6EVAEAT0VNJ1BCP5","azure-kusto",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fmicrosoft\u002Fskills\u002Fazure-kusto\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[23,24],"azure kusto","azure","2026-11-10 10:12:30",false,"# Azure Data Explorer (Kusto) Query & Analytics\n\nExecute KQL queries and manage Azure Data Explorer resources for fast, scalable big data analytics on log, telemetry, and time series data.\n\n## Skill Activation Triggers\n\n**Use this skill immediately when the user asks to:**\n- \"Query my Kusto database for [data pattern]\"\n- \"Show me events in the last hour from Azure Data Explorer\"\n- \"Analyze logs in my ADX cluster\"\n- \"Run a KQL query on [database]\"\n- \"What tables are in my Kusto database?\"\n- \"Show me the schema for [table]\"\n- \"List my Azure Data Explorer clusters\"\n- \"Aggregate telemetry data by [dimension]\"\n- \"Create a time series chart from my logs\"\n\n**Key Indicators:**\n- Mentions \"Kusto\", \"Azure Data Explorer\", \"ADX\", or \"KQL\"\n- Log analytics or telemetry analysis requests\n- Time series data exploration\n- IoT data analysis queries\n- SIEM or security analytics tasks\n- Requests for data aggregation on large datasets\n- Performance monitoring or APM queries\n\n## Overview\n\nThis skill enables querying and managing Azure Data Explorer (Kusto), a fast and highly scalable data exploration service optimized for log and telemetry data. Azure Data Explorer provides sub-second query performance on billions of records using the Kusto Query Language (KQL).\n\nKey capabilities:\n- **Query Execution**: Run KQL queries against massive datasets\n- **Schema Exploration**: Discover tables, columns, and data types\n- **Resource Management**: List clusters and databases\n- **Analytics**: Aggregations, time series, anomaly detection, machine learning\n\n## Core Workflow\n\n1. **Discover Resources**: List available clusters and databases in subscription\n2. **Explore Schema**: Retrieve table structures to understand data model\n3. **Query Data**: Execute KQL queries for analysis, filtering, aggregation\n4. **Analyze Results**: Process query output for insights and reporting\n\n## Query Patterns\n\n### Pattern 1: Basic Data Retrieval\nFetch recent records from a table with simple filtering.\n\n**Example KQL**:\n```kql\nEvents\n| where Timestamp > ago(1h)\n| take 100\n```\n\n**Use for**: Quick data inspection, recent event retrieval\n\n### Pattern 2: Aggregation Analysis\nSummarize data by dimensions for insights and reporting.\n\n**Example KQL**:\n```kql\nEvents\n| summarize count() by EventType, bin(Timestamp, 1h)\n| order by count_ desc\n```\n\n**Use for**: Event counting, distribution analysis, top-N queries\n\n### Pattern 3: Time Series Analytics\nAnalyze data over time windows for trends and patterns.\n\n**Example KQL**:\n```kql\nTelemetry\n| where Timestamp > ago(24h)\n| summarize avg(ResponseTime), percentiles(ResponseTime, 50, 95, 99) by bin(Timestamp, 5m)\n| render timechart\n```\n\n**Use for**: Performance monitoring, trend analysis, anomaly detection\n\n### Pattern 4: Join and Correlation\nCombine multiple tables for cross-dataset analysis.\n\n**Example KQL**:\n```kql\nEvents\n| where EventType == \"Error\"\n| join kind=inner (\n    Logs\n    | where Severity == \"Critical\"\n) on CorrelationId\n| project Timestamp, EventType, LogMessage, Severity\n```\n\n**Use for**: Root cause analysis, correlated event tracking\n\n### Pattern 5: Schema Discovery\nExplore table structure before querying.\n\n**Tools**: `kusto_table_schema_get`\n\n**Use for**: Understanding data model, query planning\n\n## Key Data Fields\n\nWhen executing queries, common field patterns:\n- **Timestamp**: Time of event (datetime) - use `ago()`, `between()`, `bin()` for time filtering\n- **EventType\u002FCategory**: Classification field for grouping\n- **CorrelationId\u002FSessionId**: For tracing related events\n- **Severity\u002FLevel**: For filtering by importance\n- **Dimensions**: Custom properties for grouping and filtering\n\n## Result Format\n\nQuery results include:\n- **Columns**: Field names and data types\n- **Rows**: Data records matching query\n- **Statistics**: Row count, execution time, resource utilization\n- **Visualization**: Chart rendering hints (timechart, barchart, etc.)\n\n## KQL Best Practices\n\n**? Performance Optimized:**\n- Filter early: Use `where` before joins and aggregations\n- Limit result size: Use `take` or `limit` to reduce data transfer\n- Time filters: Always filter by time range for time series data\n- Indexed columns: Filter on indexed columns first\n\n**? Query Patterns:**\n- Use `summarize` for aggregations instead of `count()` alone\n- Use `bin()` for time bucketing in time series\n- Use `project` to select only needed columns\n- Use `extend` to add calculated fields\n\n**? Common Functions:**\n- `ago(timespan)`: Relative time (ago(1h), ago(7d))\n- `between(start .. end)`: Range filtering\n- `startswith()`, `contains()`, `matches regex`: String filtering\n- `parse`, `extract`: Extract values from strings\n- `percentiles()`, `avg()`, `sum()`, `max()`, `min()`: Aggregations\n\n## Best Practices\n\n- Always include time range filters to optimize query performance\n- Use `take` or `limit` for exploratory queries to avoid large result sets\n- Leverage `summarize` for aggregations instead of client-side processing\n- Store frequently-used queries as functions in the database\n- Use materialized views for repeated aggregations\n- Monitor query performance and resource consumption\n- Apply data retention policies to manage storage costs\n- Use streaming ingestion for real-time analytics (\u003C 1 second latency)\n- Integrate with Azure Monitor for operational insights\n\n## MCP Tools Used\n\n| Tool | Purpose |\n|------|---------|\n| `kusto_cluster_list` | List all Azure Data Explorer clusters in a subscription |\n| `kusto_database_list` | List all databases in a specific Kusto cluster |\n| `kusto_query` | Execute KQL queries against a Kusto database |\n| `kusto_table_schema_get` | Retrieve schema information for a specific table |\n\n**Required Parameters**:\n- `subscription`: Azure subscription ID or display name\n- `cluster`: Kusto cluster name (e.g., \"mycluster\")\n- `database`: Database name\n- `query`: KQL query string (for query operations)\n- `table`: Table name (for schema operations)\n\n**Optional Parameters**:\n- `resource-group`: Resource group name (for listing operations)\n- `tenant`: Azure AD tenant ID\n\n## Fallback Strategy: Azure CLI Commands\n\nIf Azure MCP Kusto tools fail, timeout, or are unavailable, use Azure CLI commands as fallback.\n\n### CLI Command Reference\n\n| Operation | Azure CLI Command |\n|-----------|-------------------|\n| List clusters | `az kusto cluster list --resource-group \u003Crg-name>` |\n| List databases | `az kusto database list --cluster-name \u003Ccluster> --resource-group \u003Crg-name>` |\n| Show cluster | `az kusto cluster show --name \u003Ccluster> --resource-group \u003Crg-name>` |\n| Show database | `az kusto database show --cluster-name \u003Ccluster> --database-name \u003Cdb> --resource-group \u003Crg-name>` |\n\n### KQL Query via Azure CLI\n\nFor queries, use the Kusto REST API or direct cluster URL:\n```bash\naz rest --method post \\\n  --url \"https:\u002F\u002F\u003Ccluster>.\u003Cregion>.kusto.windows.net\u002Fv1\u002Frest\u002Fquery\" \\\n  --body \"{ \\\"db\\\": \\\"\u003Cdatabase>\\\", \\\"csl\\\": \\\"\u003Ckql-query>\\\" }\"\n```\n\n### When to Fallback\n\nSwitch to Azure CLI when:\n- MCP tool returns timeout error (queries > 60 seconds)\n- MCP tool returns \"service unavailable\" or connection errors\n- Authentication failures with MCP tools\n- Empty response when database is known to have data\n\n## Common Issues\n\n- **Access Denied**: Verify database permissions (Viewer role minimum for queries)\n- **Query Timeout**: Optimize query with time filters, reduce result set, or increase timeout\n- **Syntax Error**: Validate KQL syntax - common issues: missing pipes, incorrect operators\n- **Empty Results**: Check time range filters (may be too restrictive), verify table name\n- **Cluster Not Found**: Check cluster name format (exclude \".kusto.windows.net\" suffix)\n- **High CPU Usage**: Query too broad - add filters, reduce time range, limit aggregations\n- **Ingestion Lag**: Streaming data may have 1-30 second delay depending on ingestion method\n\n## Use Cases\n\n- **Log Analytics**: Application logs, system logs, audit logs\n- **IoT Analytics**: Sensor data, device telemetry, real-time monitoring\n- **Security Analytics**: SIEM data, threat detection, security event correlation\n- **APM**: Application performance metrics, user behavior, error tracking\n- **Business Intelligence**: Clickstream analysis, user analytics, operational KPIs\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Fmicrosoft\u002Fskills\u002Fazure-kusto",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":39,"prompt":49,"zipAvailable":50},[40,43,46],{"tool":41,"command":42},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill azure-kusto",{"tool":44,"command":45},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill azure-kusto",{"tool":47,"command":48},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill azure-kusto","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fmicrosoft\u002Fskills\u002Fazure-kusto\u002FSKILL.md",true,[],[53,63,73,82,88,95],{"skillNo":54,"name":55,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":56,"categories":57,"keywords":59,"publishedAt":25},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[58],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[60,61,62],"model","model hierarchy","model hierarchy skill",{"skillNo":64,"name":65,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":69,"publishedAt":25},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[68],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[70,71,72],"MCP","zoom","zoom mcp",{"skillNo":74,"name":75,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":25},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[79,80,81,71],"sdk","zoom apps sdk","apps",{"skillNo":83,"name":84,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":25},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[84],{"skillNo":89,"name":90,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":94,"publishedAt":25},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[93],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[90],{"skillNo":96,"name":97,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":25},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[97]]