.show ingestion mapping

 .show table MyTable ingestion csv mapping "Mapping1"

.show table MyTable ingestion csv mappings .show table MyTable ingestion mappings .show database MyDatabase ingestion csv mappings

from: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/management/show-ingestion-mapping-command

Use wildcard to search Kusto database

 find in (database('db_name_*').table_name_*_test) where isnotempty(['col1'])
| where time >= datetime(2021-05-05T00:00:00.00Z)
| where ['col1'] has "keyword"
| project ['col1']
| limit 500
| order by time desc

Show all databases row count

 

.show databases details

| project DatabaseName, TotalSize

| order by TotalSize desc

Kusto convert unix timestamp to datetime format

 

Example: Unix time

Unix time (also known as POSIX time or UNIX Epoch time) is a system for describing a point in time as the number of seconds that have elapsed since 00:00:00 Thursday, 1 January 1970, Coordinated Universal Time (UTC), minus leap seconds.

If your data includes representation of Unix time as an integer, or you require converting to it, the following functions are available:

Kusto

let fromUnixTime = (t:long)
{ 
    datetime(1970-01-01) + t * 1sec 
};
print result = fromUnixTime(1546897531)

EXAMPLE: UNIX TIME

result
2019-01-07 21:45:31.0000000

Kusto

let toUnixTime = (dt:datetime) 
{ 
    (dt - datetime(1970-01-01)) / 1s 
};
print result = toUnixTime(datetime(2019-01-07 21:45:31.0000000))

TABLE 2

result
1546897531

from : https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/datetime-timespan-arithmetic

How can I see the rowcounts for tables in a log analytics workspace?

 The following query returns table names and row counts for all tables with at least one row for the time range selected.

union withsource=sourceTable *
| project sourceTable
| summarize count() by sourceTable

from : https://stackoverflow.com/questions/56706816/how-can-i-see-the-rowcounts-for-tables-in-a-log-analytics-workspace