Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
dcc99e9
Update web-sync.md
spelluru Jun 18, 2025
89563a8
Find My Partner - Freshness Pass
hzargari-ms Jun 7, 2026
dcdb271
documentor revisions
hzargari-ms Jun 7, 2026
972287c
Query Monitor Data - Freshness Pass
hzargari-ms Jun 7, 2026
4a25e22
Update slm_embeddings_fl Fabric docs for Linux Python image
adieldar Jun 7, 2026
686bb85
PR reviewer comment
hzargari-ms Jun 10, 2026
87fa274
Clone database schema - freshness pass
hzargari-ms Jun 10, 2026
af2a888
Graph tutorial - freshness pass (#7504)
hzargari-ms Jun 10, 2026
cffa2da
Ingest data splunk - freshness pass (#7506)
hzargari-ms Jun 10, 2026
a68bbf7
Merge pull request #7507 from MicrosoftDocs/main
learn-build-service-prod[bot] Jun 11, 2026
85b27b7
Update start-for-free.md with terms and disclaimer (#7207)
yogilad Jun 11, 2026
397b3ba
Merge pull request #7508 from MicrosoftDocs/main
learn-build-service-prod[bot] Jun 11, 2026
e34d8f5
Merge pull request #7501 from adieldar/fix-slm-embeddings-fl-fabric-l…
prmerger-automator[bot] Jun 11, 2026
a11e352
5 copilot/add cela content to mcp article (#7503)
ktalmor Jun 11, 2026
d9b0a36
Merge pull request #7505 from hzargari-ms/wi-584716-database-schema-f…
prmerger-automator[bot] Jun 11, 2026
abbd1c8
Merge pull request #7499 from hzargari-ms/wi-584571-query-monitor-dat…
prmerger-automator[bot] Jun 11, 2026
ccc0e3b
Merge pull request #7509 from MicrosoftDocs/main
learn-build-service-prod[bot] Jun 11, 2026
5451b26
warning fixes
hzargari-ms Jun 14, 2026
2b3c72b
Merge pull request #7498 from hzargari-ms/wi-584734-find-adx-partner-…
prmerger-automator[bot] Jun 14, 2026
8ecb5d2
Merge pull request #7512 from MicrosoftDocs/main
learn-build-service-prod[bot] Jun 14, 2026
54d82a9
Add performance note for Parquet continuous export
spelluru Jun 16, 2026
aaba58d
Merge pull request #7517 from spelluru/patch-1
prmerger-automator[bot] Jun 16, 2026
d00d25d
Merge pull request #7518 from MicrosoftDocs/main
learn-build-service-prod[bot] Jun 16, 2026
8780a0f
[AQ] edit pass: azure-data-explorer-article-mcp (#7510)
ShawnJackson Jun 18, 2026
cec4324
Merge pull request #7521 from MicrosoftDocs/main
learn-build-service-prod[bot] Jun 18, 2026
761cb1e
Merging changes synced from https://github.com/MicrosoftDocs/dataexpl…
Jun 18, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 10 additions & 9 deletions data-explorer/clone-database-schema.md
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
---
title: Clone a database schema - Azure Data Explorer
description: Learn how to clone a database schema in Azure Data Explorer.
description: Learn how to clone an Azure Data Explorer database schema using management commands. Export your schema as a CSL script and recreate it in a target database.
ms.reviewer: zivc
ms.topic: how-to
ms.date: 09/26/2023
ms.date: 06/10/2026
#customer intent: As a database administrator, I want to clone a database schema so that I can replicate structure to another database without copying data.
---

# Clone a database schema in Azure Data Explorer
Expand All @@ -16,10 +17,10 @@ This article explains how to use [management commands](/kusto/management/index?v

## Clone a database schema

The following steps describe how to clone a database schema using the [Azure Data Explorer web UI](https://dataexplorer.azure.com/). Alternatively, you can use the [Kusto client libraries](/kusto/api/client-libraries?view=azure-data-explorer&preserve-view=true) to run the same management commands. For more information, see [Create an app to run management commands](/kusto/api/get-started/app-management-commands?view=azure-data-explorer&preserve-view=true).
These steps describe how to clone a database schema using the [Azure Data Explorer web UI](https://dataexplorer.azure.com/). Alternatively, you can use the [Kusto client libraries](/kusto/api/client-libraries?view=azure-data-explorer&preserve-view=true) to run the same management commands. For more information, see [Create an app to run management commands](/kusto/api/get-started/app-management-commands?view=azure-data-explorer&preserve-view=true).

1. From the left menu, select **Query**.
1. In the [connection pane](web-ui-query-overview.md#view-clusters-and-databases), select the database whose schema you want to clone.
1. Select **Query** from the left menu.
1. Select the database whose schema you want to clone in the [connection pane](web-ui-query-overview.md#view-clusters-and-databases).

:::image type="content" source="media/clone-database-schema/select-database.png" alt-text="Screenshot of selected database in connection pane." lightbox="media/clone-database-schema/select-database.png":::

Expand All @@ -29,9 +30,9 @@ The following steps describe how to clone a database schema using the [Azure Dat
.show database schema as csl script with (ShowObfuscatedStrings = true)
```

This command returns a script of management commands to recreate the database schema. Note the number of returned records, which is used for verification in a later step. For more information, see [.show database schema command](/kusto/management/show-schema-database?view=azure-data-explorer&preserve-view=true#show-database-schema-as-csl-script).
This command returns a script of management commands to recreate the database schema. Note the number of returned records, which you'll use for verification in a later step. For more information, see [.show database schema command](/kusto/management/show-schema-database?view=azure-data-explorer&preserve-view=true#show-database-schema-as-csl-script).

1. Copy the CSL script output. To do so, select all of the returned rows. Then, either right-click and select **Copy** or use the *Ctrl + C* keyboard shortcut.
1. Copy the CSL script output by selecting all of the returned rows. Then, either right-click and select **Copy** or use the Ctrl+C keyboard shortcut.

:::image type="content" source="media/clone-database-schema/copy-script-output.png" alt-text="Screenshot of the selected records and right-click menu." lightbox="media/clone-database-schema/copy-script-output.png":::

Expand All @@ -50,9 +51,9 @@ The following steps describe how to clone a database schema using the [Azure Dat
.execute database script <| <CSLScript>
```

This command runs the commands from the script, recreating the database schema on the new database. For more information, see [.execute database script command](/kusto/management/execute-database-script?view=azure-data-explorer&preserve-view=true).
This command executes the script, recreating the database schema on the new database. For more information, see [.execute database script command](/kusto/management/execute-database-script?view=azure-data-explorer&preserve-view=true).

1. Verify that the script ran correctly. To do so, check that the number of returned records is the same as the records from the show schema command. Then, scroll to the final command and check that the `Result` column is `Complete`. If a failure occurs, troubleshoot and run the command again.
1. Verify that the script ran correctly by checking that the number of returned records matches the records from the show schema command. Then, scroll to the final command and check that the `Result` column is `Complete`. If a failure occurs, troubleshoot and run the command again.

> [!NOTE]
> You can rerun the script as often as needed without clearing resources from the previous run.
Expand Down
141 changes: 75 additions & 66 deletions data-explorer/find-my-partner.md

Large diffs are not rendered by default.

30 changes: 15 additions & 15 deletions data-explorer/ingest-data-splunk.md
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
---
title: Ingest data from Splunk to Azure Data Explorer
description: In this article, you learn how to ingest (load) data into Azure Data Explorer from Splunk
description: Learn how to use the Azure Data Explorer Splunk add-on to ingest log and telemetry data from Splunk Enterprise into an Azure Data Explorer table.
ms.reviewer: takamara
ms.topic: how-to
ms.date: 09/28/2023
ms.date: 06/10/2026
ms.custom: sfi-image-nochange
#Customer intent: As a DevOps engineer, I want to use Splunk to pipeline logs and ingest into Azure Data Explorer so that I can analyze them later.
---
Expand All @@ -14,7 +14,7 @@ ms.custom: sfi-image-nochange

[Splunk Enterprise](https://www.splunk.com/en_us/products/splunk-enterprise.html) is a software platform that allows you to ingest data from many sources simultaneously. The Splunk indexer processes the data and stores it by default in the main index or a specified custom index. Searching in Splunk uses the indexed data for creating metrics, dashboards, and alerts. Azure Data Explorer is a fast and highly scalable data exploration service for log and telemetry data.

In this article, you learn how to the Azure Data Explorer Splunk add-on to send data from Splunk to a table in your cluster. You initially create a table and data mapping, then direct Splunk to send data into the table, and then validate the results.
In this article, you'll learn how to use the Azure Data Explorer Splunk add-on to send data from Splunk to a table in your cluster. You create a table and data mapping, direct Splunk to send data into the table, and then validate the results.

The following scenarios are most suitable for ingesting data into Azure Data Explorer:

Expand All @@ -31,9 +31,9 @@ The following scenarios are most suitable for ingesting data into Azure Data Exp

## Create a table and a mapping object

After you have a cluster and a database, create a table with a schema that matches your Splunk data. You also create a mapping object that is used to transform the incoming data into the target table schema.
After you have a cluster and a database, create a table with a schema that matches your Splunk data. You also create a mapping object that transforms the incoming data into the target table schema.

In the following example, you create a table named `WeatherAlert` with four columns: `Timestamp`, `Temperature`, `Humidity`, and `Weather`. You also create a new mapping named `WeatherAlert_Json_Mapping` that extracts properties from the incoming json as noted by the `path` and outputs them to the specified `column`.
In the following example, you create a table named `WeatherAlert` with four columns: `Timestamp`, `Temperature`, `Humidity`, and `Weather`. You also create a mapping named `WeatherAlert_Json_Mapping` that extracts properties from the incoming JSON as noted by the `path` and outputs them to the specified `column`.

In the [web UI query editor](web-ui-query-overview.md#write-and-run-queries), run the following commands to create the table and mapping:

Expand All @@ -43,7 +43,7 @@ In the [web UI query editor](web-ui-query-overview.md#write-and-run-queries), ru
.create table WeatherAlert (Timestamp: datetime, Temperature: string, Humidity: string, Weather: string)
```

1. Verify that the table `WeatherAlert` was created and is empty:
1. Verify that the `WeatherAlert` table was created and is empty:

```Kusto
WeatherAlert
Expand All @@ -61,9 +61,9 @@ In the [web UI query editor](web-ui-query-overview.md#write-and-run-queries), ru
]```
~~~

2. Use the service principal from the [Prerequisites](#prerequisites) to grant permission to work with the database.
1. Use the service principal from the [Prerequisites](#prerequisites) to grant permission to work with the database.

```kusto
```Kusto
.add database YOUR_DATABASE_NAME admins ('aadapp=YOUR_APP_ID;YOUR_TENANT_ID') 'Entra App'
```

Expand All @@ -74,7 +74,7 @@ The Splunk add-on communicates with Azure Data Explorer and sends the data to th
1. Download the [Azure Data Explorer add-on](https://splunkbase.splunk.com/app/6979).
1. Sign in to your Splunk instance as an administrator.
1. Go to **Apps** > **Manage Apps**.
1. Select **Install app from file** and then *Azure Data Explorer add-on* file you downloaded.
1. Select **Install app from file**, and then select the *Azure Data Explorer add-on* file you downloaded.
1. Follow the prompts to complete the installation.
1. Select **Restart Now**.
1. Verify that the add-on is installed by going to **Dashboard** > **Alert Actions** and looking for the *Azure Data Explorer add-on*.
Expand All @@ -83,12 +83,12 @@ The Splunk add-on communicates with Azure Data Explorer and sends the data to th

## Create a new index in Splunk

Create an index in Splunk specifying the criteria for the data you want to send to Azure Data Explorer.
Create an index in Splunk that specifies the criteria for the data you want to send to Azure Data Explorer.

1. Sign in to your Splunk instance as an administrator.
1. Go to **Settings** > **Indexes**.
1. Specify a name for the index and configure the criteria for the data you want to send to Azure Data Explorer.
1. Configure the remaining properties as required and then save the index.
1. Specify a name for the index, and configure the criteria for the data you want to send to Azure Data Explorer.
1. Configure the remaining properties as required, and then save the index.

## Configure the Splunk add-on to send data to Azure Data Explorer

Expand All @@ -115,7 +115,7 @@ Create an index in Splunk specifying the criteria for the data you want to send
| **Table** | Specify the name of the table you want to send the data to. |
| **Mapping** | Specify the name of the mapping object you created earlier. |
| **Remove Extra Fields** | Select this option to remove any empty fields from the data sent to your cluster. |
| **Durable Mode** | Select this option to enable durability mode during ingestion. When set to true, the ingestion throughput is impacted. |
| **Durable Mode** | Select this option to enable durability mode during ingestion. When set to true, ingestion throughput is affected. |

:::image type="content" source="media/ingest-data-splunk/save-alert-as-connection.png" alt-text="Screenshot of create alert dialog showing the Azure Data Explorer add-on connection settings." lightbox="media/ingest-data-splunk/save-alert-as-connection.png":::

Expand All @@ -126,7 +126,7 @@ Create an index in Splunk specifying the criteria for the data you want to send

## Verify that data is ingested into Azure Data Explorer

Once the alert is triggered, data is sent to your Azure Data Explorer table. You can verify that the data is ingested by running a query in the [web UI query editor](web-ui-query-overview.md#write-and-run-queries).
After the alert is triggered, data is sent to your Azure Data Explorer table. You can verify that the data is ingested by running a query in the [web UI query editor](web-ui-query-overview.md#write-and-run-queries).

1. Run the following query to verify that data is ingested into the table:

Expand All @@ -146,4 +146,4 @@ Once the alert is triggered, data is sent to your Azure Data Explorer table. You

## Related content

* [Write queries](/azure/data-explorer/kusto/query/tutorials/learn-common-operators)
* [Write queries](kusto/query/tutorials/learn-common-operators.md)
Loading