Skip to content

Commit a12598f

Browse files
Merge pull request #314559 from zeinab-mk/patch-4
Update KQL queries section with query considerations
2 parents ee7a504 + d6cd675 commit a12598f

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

articles/sentinel/datalake/kql-queries.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,7 @@ external_table("AADRiskyUsers")
133133
## Query considerations and limitations
134134

135135
+ Querying legacy tables such as AzureDiagnostics is not supported.
136+
+ Empty tables don’t appear in schema view, and queries aren’t supported until the table contains data.
136137
+ Queries are run against the workspaces you selected. Make sure you select the correct workspaces before running a query.
137138
+ Executing KQL queries on the Microsoft Sentinel data lake incurs charges based on query billing meters. For more information, see [Plan costs and understand Microsoft Sentinel pricing and billing](../billing.md#data-lake-tier).
138139
+ Review data ingestion and table retention policy. Before setting query time range, be aware of data retention on your data lake tables and whether data is available for selected time range. For more information, see [Manage data tiers and retention in Microsoft Defender portal](https://aka.ms/manage-data-defender-portal-overview).

0 commit comments

Comments
 (0)