🌴
The Amazing KQL
  • The Amazing KQL
  • 💠KQL Quick Guide
    • Useful Resources 🔦
    • My favorites 😍
      • search
      • take
      • where
      • summarize
        • arg_max()
        • count, countif
        • dcount, dcountif
        • take_any
      • distinct
      • case
      • project
        • project-reorder
        • project-away
        • project-rename
        • project-keep
      • sort by
      • extend
      • extract
        • extract_all
      • parse
      • stract
      • count
        • countif
      • mv-expand
      • dcount
        • dcountif
      • Create table
      • let
      • join
      • union
      • materialize
    • Need to practice more 🎯
      • toscalar
      • range
      • make-series
      • series_outliers
      • set_differenc
      • pack
      • summarize
        • make_bag
        • make_set, make_list
      • evaluate
        • pivot
        • bag_unpack
        • pack_all
      • mv-expand
      • set_difference
      • render
    • Need to learn later 🐢
      • scan
      • ExtractParseParse-kv-Tabular
      • decode
      • mv-apply
      • prev and next
      • row_cumsum
      • any
      • top-nested
      • Time Series
        • series_stats
        • series_fir
        • series_iir
        • series_fit_line
        • series_fit_2lines
      • Machine Learning
        • basket
        • autocluster
        • diffpatterns
        • reduce
  • 💻Microsoft Endpoint Manager
    • Device Inventory
      • Device OS version
      • Same AAD Device ID and Intune Device ID
Powered by GitBook
On this page
  1. KQL Quick Guide
  2. My favorites 😍

take

In the previous chapter, we talked about search, it often returns lots of rows in the result. It's useful to use take to get some examples of the results but not all of them. There is no guarantee which rows it will return or if they are exact same.

IntuneDevices
| search DeviceName matches regex "[A-Z]-"
| take 10

PrevioussearchNextwhere

Last updated 3 years ago

💠