Invoke-XdrAzureDataExplorerQuery
SYNOPSIS
Executes a KQL query or management command against an Azure Data Explorer cluster.
SYNTAX
Invoke-XdrAzureDataExplorerQuery [-Query] <String> [[-Database] <String>] [[-ServerTimeout] <TimeSpan>]
[[-RequestTimeout] <Int32>] [-Raw] [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Runs a Kusto Query Language (KQL) query or management command against the configured Azure Data Explorer cluster and returns the results as PowerShell objects.
Regular KQL queries are sent to the v2/rest/query endpoint. Management commands (queries starting with '.') are sent to the v1/rest/mgmt endpoint.
Connection settings must be configured first using Set-XdrAzureDataExplorerConnection.
EXAMPLES
EXAMPLE 1
Invoke-XdrAzureDataExplorerQuery -Query 'XDRAlerts | take 10'
Runs a KQL query and returns the first 10 alerts as objects.
EXAMPLE 2
Invoke-XdrAzureDataExplorerQuery -Query '.show tables'
Runs a management command to list all tables.
EXAMPLE 3
Invoke-XdrAzureDataExplorerQuery -Query 'StormEvents | count' -Database 'Samples' -ServerTimeout ([timespan]::FromMinutes(10))
Runs a query against a specific database with a custom server timeout.
PARAMETERS
-Query
The KQL query or management command to execute.
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Database
Optional database name to override the database from connection settings.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ServerTimeout
Server-side query timeout as a TimeSpan. Default is 4 minutes.
Type: TimeSpan
Parameter Sets: (All)
Aliases:
Required: False
Position: 3
Default value: [timespan]::FromMinutes(4)
Accept pipeline input: False
Accept wildcard characters: False
-RequestTimeout
Client-side HTTP timeout in seconds. Default is 300 seconds. Currently only server-side timeout is enforced via the request body.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 4
Default value: 300
Accept pipeline input: False
Accept wildcard characters: False
-Raw
Return the raw API response instead of converting to PSCustomObject output.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.