KQL Queryset definition

This article provides a breakdown of the structure for Real-Time Queryset (KQL Queryset) definition items.

Supported formats

KQLQuerysetDefinition items support the JSON format.

Definition parts

The definition of a Real-Time Queryset item is constructed as follows:

• Path: The path to the file that contains the JSON definition.
• Payload: See Example of payload content decoded from Base64
• PayloadType: InlineBase64

Example of payload content decoded from Base64

The following example payload is a JSON object that describes a Queryset containing a single tab with the query print 10.

{
  "content": "{\"payload\":{\"tabs\":[{\"id\":\"ad801b9d-1091-4264-8f7a-8e4928b9e138\",\"queryRange\":{\"startLineNumber\":1,\"startColumn\":1,\"endLineNumber\":1,\"endColumn\":9},\"text\":\"print 10\",\"commandInContext\":\"print 10\",\"executionStatus\":\"notStarted\",\"clientRequestId\":null,\"commandType\":\"Query\",\"commandWithoutLeadingComments\":\"print 10\",\"hideEmptyColumns\":false,\"cursorPosition\":{\"lineNumber\":1,\"column\":9}}],\"tabInContext\":\"ad801b9d-1091-4264-8f7a-8e4928b9e138\",\"connections\":{}}}"
}

Definition example

{
    "parts": [
      {
        "path": "RealTimeQueryset.json",
        "payload": "eyJjb250ZW50Ijoie1wicGF5bG9hZFwiOntcInRhYnNcIjpbe1wiaWRcIjpcImFkODAxYjlkLTEwOTEtNDI2NC04ZjdhLThlNDkyOGI5ZTEzOFwiLFwicXVlcnlSYW5nZVwiOntcInN0YXJ0TGluZU51bWJlclwiOjEsXCJzdGFydENvbHVtblwiOjEsXCJlbmRMaW5lTnVtYmVyXCI6MSxcImVuZENvbHVtblwiOjl9LFwidGV4dFwiOlwicHJpbnQgMTBcIixcImNvbW1hbmRJbkNvbnRleHRcIjpcInByaW50IDEwXCIsXCJleGVjdXRpb25TdGF0dXNcIjpcIm5vdFN0YXJ0ZWRcIixcImNsaWVudFJlcXVlc3RJZFwiOm51bGwsXCJjb21tYW5kVHlwZVwiOlwiUXVlcnlcIixcImNvbW1hbmRXaXRob3V0TGVhZGluZ0NvbW1lbnRzXCI6XCJwcmludCAxMFwiLFwiaGlkZUVtcHR5Q29sdW1uc1wiOmZhbHNlLFwiY3Vyc29yUG9zaXRpb25cIjp7XCJsaW5lTnVtYmVyXCI6MSxcImNvbHVtblwiOjl9fV0sXCJ0YWJJbkNvbnRleHRcIjpcImFkODAxYjlkLTEwOTEtNDI2NC04ZjdhLThlNDkyOGI5ZTEzOFwiLFwiY29ubmVjdGlvbnNcIjp7fX19In0",
        "payloadType": "InlineBase64"
      },
      {
        "path": ".platform",
        "payload": "ZG90UGxhdGZvcm1CYXNlNjRTdHJpbmc=",
        "payloadType": "InlineBase64"
      }
    ]
  }