kusto_graph_query
Read-only
Execute Kusto graph queries with automatic snapshot or transient graph fallback, requiring graph-match and project clauses for results.
Instructions
Intelligently executes a graph query using snapshots if they exist,
otherwise falls back to transient graphs.
If no database is provided, uses the default database.
:param graph_name: Name of the graph to query.
:param query: The KQL query to execute after the graph() function.
Must include proper project clause for graph-match queries.
:param cluster_uri: The URI of the Kusto cluster.
:param database: Optional database name. If not provided, uses the default database.
:param client_request_properties: Optional dictionary of additional client request properties.
:return: List of dictionaries containing query results.
Critical:
* Graph queries must have a graph-match clause and a projection clause.
Optionally they may contain a where clause.
* Graph entities are only accessible in the graph-match scope.
When leaving that scope (sub-sequent '|'), the data is treated as a table,
and graph-specific functions (like labels()) will not be available.
* Always prefer expressing everything with graph patterns.
Avoid using graph-to-table operator unless you have no other way around it.
* There is no id() function on graph entities. If you need a unique identifier,
make sure to check the schema and use an appropriate property.
* There is no `type` property on graph entities.
Use `labels()` function to get the list of labels for a node or edge.
* Properties that are used outside the graph-match context are renamed to `_` instead of `.`.
For example, `node.name` becomes `node_name`.
* For variable length paths, you can use `all` or `any` to enforce conditions on all/any edges
in variable path length elements (e.g. `()-[e*1..3]->() where all(e, labels() has 'Label')`).
Examples:
# Basic node counting with graph-match (MUST include project clause):
kusto_graph_query(
"MyGraph",
"| graph-match (node) project labels=labels(node)
| mv-expand label = labels
| summarize count() by tostring(label)",
cluster_uri
)
# Relationship matching:
kusto_graph_query(
"MyGraph",
"| graph-match (house)-[relationship]->(character)
where labels(house) has 'House' and labels(character) has 'Character'
project house.name, character.firstName, character.lastName
| project house_name=house_name, character_full_name=character_firstName + ' ' + character_lastName
| limit 10",
cluster_uri
)
# Variable length path matching:
kusto_graph_query(
"MyGraph",
"| graph-match (source)-[path*1..3]->(m)-[e]->(target)
where all(path, labels() has 'Label')
project source, destination, path, m, e, target
| take 100",
cluster_uri
)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| graph_name | Yes | ||
| query | Yes | ||
| cluster_uri | Yes | ||
| database | Yes | ||
| client_request_properties | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||