kql-queryset
Manage KQL querysets (saved KQL queries)
Authentication scope: fabric
List KQL querysets in a workspace
fabio kql-queryset list --workspace <value>| Flag | Type | Required | Description |
|---|---|---|---|
--workspace |
string |
Yes | Workspace ID |
Read-only · Returns list
Show details of a KQL queryset
fabio kql-queryset show --workspace <value> --id <value>| Flag | Type | Required | Description |
|---|---|---|---|
--workspace |
string |
Yes | Workspace ID |
--id |
string |
Yes | KQL queryset ID |
Read-only · Returns object
create
Section titled “create”Create a new KQL queryset
fabio kql-queryset create --workspace <value> --name <value>| Flag | Type | Required | Description |
|---|---|---|---|
--workspace |
string |
Yes | Workspace ID |
--name |
string |
Yes | Queryset display name |
--description |
string |
No | Optional description |
--sensitivity-label |
string |
No | Sensitivity label ID to apply on creation |
Mutates state · Returns object
update
Section titled “update”Update KQL queryset properties (name and/or description)
fabio kql-queryset update --workspace <value> --id <value>| Flag | Type | Required | Description |
|---|---|---|---|
--workspace |
string |
Yes | Workspace ID |
--id |
string |
Yes | KQL queryset ID |
--name |
string |
No | New display name |
--description |
string |
No | New description |
Mutates state · Returns object
delete
Section titled “delete”Delete a KQL queryset
fabio kql-queryset delete --workspace <value> --id <value>| Flag | Type | Required | Description |
|---|---|---|---|
--workspace |
string |
Yes | Workspace ID |
--id |
string |
Yes | KQL queryset ID |
--hard-delete |
bool |
No | Permanently delete (cannot be recovered) |
Mutates state · Destructive · Returns void
get-definition
Section titled “get-definition”Get the definition of a KQL queryset
fabio kql-queryset get-definition --workspace <value> --id <value>| Flag | Type | Required | Description |
|---|---|---|---|
--workspace |
string |
Yes | Workspace ID |
--id |
string |
Yes | KQL queryset ID |
--decode |
bool |
No | Decode base64 payloads inline (adds decodedPayload field) |
Read-only · Long-running operation · Returns object
update-definition
Section titled “update-definition”Update the definition of a KQL queryset
fabio kql-queryset update-definition --workspace <value> --id <value>| Flag | Type | Required | Description |
|---|---|---|---|
--workspace |
string |
Yes | Workspace ID |
--id |
string |
Yes | KQL queryset ID |
--file |
string |
No | KQL queryset file path (reads file content) |
--content |
string |
No | KQL queryset content (inline) |
Mutates state · Long-running operation · Returns void
Run a saved query tab from the queryset against its configured data source
fabio kql-queryset run --workspace <value> --id <value>| Flag | Type | Required | Description |
|---|---|---|---|
--workspace |
string |
Yes | Workspace ID |
--id |
string |
Yes | KQL queryset ID |
--tab |
string |
No | Tab name or zero-based index to execute (default: first tab) |
--query-uri |
string |
No | Override the Kusto query URI (default: from queryset data source) |
Examples
fabio kql-queryset run --workspace $WS --id $QS --tab "Hourly Summary"Read-only · Returns object
add-tab
Section titled “add-tab”Add a saved query tab bound to a KQL database (authors the RealTimeQueryset.json data source + tab)
fabio kql-queryset add-tab --workspace <value> --id <value> --kql-database <value> --title <value>| Flag | Type | Required | Description |
|---|---|---|---|
--workspace |
string |
Yes | Workspace ID |
--id |
string |
Yes | KQL queryset ID |
--kql-database |
string |
Yes | The KQL database (in an eventhouse) the tab queries |
--title |
string |
Yes | Tab title |
--kql |
string |
No | KQL query text (inline, @file, or omit to read from stdin) |
Mutates state · Returns object