Skip to content
DP-700 Fabric Engineer Hub

Cheatsheet: Real-Time Intelligence, Eventstreams & KQL

Cheatsheet: Real-Time Intelligence, Eventstreams & KQL

Source

  • Content type: Quick-Reference Cheatsheet
  • Target Exam: Exam DP-700
  • Date captured: 2026-08-15
  • Last reviewed: 2026-08-15

1. Eventstream Ingestion & Routing

  • Sources: Custom App (Kafka/REST), Azure Event Hubs, Azure IoT Hub, Amazon Kinesis, Database CDC.
  • Destinations: KQL Database (Eventhouse), Lakehouse (Delta Table), Custom App / Reflex (Data Activator).
  • Transformations: Filter, Manage Fields, Aggregate (Tumbling/Hopping/Sliding windows), Union, Expand JSON arrays.

2. KQL Core Tabular Operators

// 1. Time-bucketed Aggregation with Early Filtering
DeviceTelemetry
| where Timestamp between (ago(7d) .. now())
| where Status == "Active"
| summarize AvgTemp = avg(Temperature), MaxTemp = max(Temperature), TotalCount = count()
    by DeviceId, bin(Timestamp, 1h)
| top 10 by MaxTemp desc


// 2. Joining Streaming Tables with Lookup Dimension
DeviceTelemetry
| where Timestamp > ago(24h)
| lookup kind=inner (DeviceMetadata | project DeviceId, Location, FirmwareVersion) on DeviceId
| project Timestamp, DeviceId, Location, Temperature, Status


// 3. String & Dynamic JSON Parsing
RawLogs
| where Timestamp > ago(1d)
| extend ParsedJson = parse_json(LogPayload)
| extend EventCode = tostring(ParsedJson.header.code), ErrorMsg = tostring(ParsedJson.body.error)
| where isnotempty(ErrorMsg)
| project Timestamp, EventCode, ErrorMsg

3. KQL Update Policy & Materialized Views

// Step 1: Create Curated Target Table
.create table CuratedTelemetry (Timestamp: datetime, DeviceId: string, Temperature: real)


// Step 2: Define Transformation Function
.create-or-alter function ProcessTelemetry() {
    RawTelemetry
    | where Temperature > -40 and Temperature < 120
    | project Timestamp = todatetime(RawData.timestamp), DeviceId = tostring(RawData.deviceId), Temperature = toreal(RawData.temp)
}


// Step 3: Attach Update Policy (Target Table)
.alter table CuratedTelemetry policy update
@'[{ "IsEnabled": true, "Source": "RawTelemetry", "Query": "ProcessTelemetry()", "IsTransactional": true }]'

4. KQL Performance Optimization & Time-Series Analytics

Query Optimization Rules

  1. Early Filtering: Always place | where Timestamp > ago(...) at the very beginning of the pipeline. The Kusto engine uses extent metadata to prune entire storage shards before loading data into memory.
  2. Project Early: Use | project to eliminate unneeded high-cardinality columns before executing join or summarize.
  3. Use lookup over join: When enriching fact tables with small dimension/lookup tables, use | lookup (optimized for broadcast) instead of standard join.

Time-Series Anomaly Detection

// Build regular time-series grid and decompose anomalies
DeviceMetrics
| where Timestamp between (ago(14d) .. now())
| make-series AvgMetric = avg(MetricValue) default=0 on Timestamp from ago(14d) to now() step 1h by DeviceId
| extend (Anomalies, Score, Baseline) = series_decompose_anomalies(AvgMetric, 1.5, -1, 'linefit')
| render anomalychart with(anomalycolumns=Anomalies, title='Metric Anomaly Detection')