Run Advanced Queries in Xplorer

Advanced queries allows you to search for more specific results using the KQL query language and its flexibility. To write a query, columns must be specified.

To use the Advanced Query syntax, click the drop down next to the Search bar and select Advanced.

As you type commands, available field names and table names will be suggested to you and can be selected without completing the full word by pressing the tab key or by left clicking on it with a mouse. Suggestions are dynamically updated as you type. To go to next line without executing the query press SHIFT + ENTER.

Auto-complete will suggest the words based on the placement within the query:

• At beginning of query: recommended table name or KQL function (let, logs, assets, etc.)
• First line: recommended KQL query syntax (where, summarize, etc.)
• After keyword: recommended columns relevant to the selected table
• After the column: recommends other operators as applicable

Click the Search button or press the Enter key to begin the query.