├── resources ├── images │ ├── kusto-logo.png │ ├── share-gist.png │ ├── create-gist.png │ └── submit-gist.png ├── participating-queries │ ├── query-01.md │ ├── query-02.md │ ├── query-03.md │ ├── query-04.md │ ├── query-05.md │ ├── query-06.md │ ├── query-07.md │ ├── query-08.md │ ├── query-09.md │ ├── query-12.md │ ├── query-10.md │ ├── query-11.md │ ├── query-15.md │ ├── query-13.md │ ├── query-14.md │ ├── query-16.md │ ├── query-18.md │ ├── query-17.md │ ├── query-19.md │ ├── query-23.md │ ├── query-24.md │ ├── query-20.md │ ├── query-21.md │ ├── query-25.md │ ├── query-26.md │ ├── query-28.md │ ├── query-22.md │ ├── query-29.md │ ├── query-27.md │ ├── query-30.md │ ├── query-31.md │ ├── query-32.md │ ├── query-33.md │ ├── query-34.md │ ├── query-36.md │ ├── query-37.md │ ├── query-35.md │ ├── query-38.md │ ├── query-39.md │ ├── query-40.md │ ├── query-42.md │ ├── query-41.md │ ├── query-44.md │ ├── query-43.md │ ├── query-45.md │ ├── query-47.md │ ├── query-46.md │ ├── query-48.md │ ├── query-50.md │ ├── query-52.md │ ├── query-49.md │ ├── query-53.md │ ├── query-51.md │ ├── query-55.md │ ├── query-54.md │ ├── query-56.md │ ├── query-57.md │ ├── query-59.md │ ├── query-58.md │ ├── query-60.md │ ├── query-61.md │ ├── query-62.md │ ├── query-63.md │ ├── query-64.md │ ├── query-65.md │ ├── query-66.md │ ├── query-68.md │ ├── query-67.md │ ├── query-71.md │ ├── query-69.md │ ├── query-73.md │ ├── query-72.md │ ├── query-70.md │ ├── query-74.md │ ├── query-75.md │ ├── query-76.md │ ├── query-77.md │ ├── query-78.md │ ├── query-80.md │ ├── query-81.md │ ├── query-79.md │ └── query-82.md └── sample-queries │ ├── sample-query-3.md │ ├── sample-query-13.md │ ├── sample-query-20.md │ ├── sample-query-12.md │ ├── sample-query-5.md │ ├── sample-query-9.md │ ├── sample-query-1.md │ ├── sample-query-17.md │ ├── sample-query-19.md │ ├── sample-query-18.md │ ├── sample-query-14.md │ ├── sample-query-10.md │ ├── sample-query-15.md │ ├── sample-query-6.md │ ├── sample-query-8.md │ ├── sample-query-16.md │ ├── sample-query-11.md │ ├── sample-query-4.md │ └── sample-query-7.md ├── SUPPORT.md ├── CODE_OF_CONDUCT.md ├── LICENSE ├── SECURITY.md └── README.md /resources/images/kusto-logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/microsoft/just-another-kusto-hacker/HEAD/resources/images/kusto-logo.png -------------------------------------------------------------------------------- /resources/images/share-gist.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/microsoft/just-another-kusto-hacker/HEAD/resources/images/share-gist.png -------------------------------------------------------------------------------- /resources/images/create-gist.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/microsoft/just-another-kusto-hacker/HEAD/resources/images/create-gist.png -------------------------------------------------------------------------------- /resources/images/submit-gist.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/microsoft/just-another-kusto-hacker/HEAD/resources/images/submit-gist.png -------------------------------------------------------------------------------- /SUPPORT.md: -------------------------------------------------------------------------------- 1 | # Support 2 | 3 | ## How to file issues and get help 4 | 5 | This project uses GitHub Issues to track bugs and feature requests. Please search the existing 6 | issues before filing new issues to avoid duplicates. For new issues, file your bug or 7 | feature request as a new Issue. 8 | 9 | ## Microsoft Support Policy 10 | 11 | Support for this **PROJECT or PRODUCT** is limited to the resources listed above. 12 | -------------------------------------------------------------------------------- /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | # Microsoft Open Source Code of Conduct 2 | 3 | This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). 4 | 5 | Resources: 6 | 7 | - [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/) 8 | - [Microsoft Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) 9 | - Contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with questions or concerns 10 | -------------------------------------------------------------------------------- /resources/participating-queries/query-01.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAC2Oyw6CMBBF93zF7NomShBqy8aFJPIbpGkaRVvalMGg8eMdH3c1mZM5c1MeJ4TLCgdg8qj3utGyrtROnVSvpWrVXtd1JbsfUT2xlmijug9hxQvCfWtS8g+w5HArZmNxMN5zxstSsA3JBcQJeAGUeQnB5PHpIC6YFqSbYG5umJGKnPl39uOMHCMV47S2BjmrVhJZQSkE/Uw5Xp3Fv+MNHJATYsQAAAA=) 2 | 3 | ```kql 4 | print hx = '4A75737420616E6F74686572204B7573746F206861636B6572' 5 | | mv-apply c = extract_all('(..)', hx) on ( 6 | summarize output = make_string(make_list(toint(strcat('0x', c)))) 7 | ) 8 | | project output 9 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-02.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAA2OUWrDQAxE/3uKIVCyCxvIprFJAr5Ae4RSjJwo9hJ7HbRy2pQevkIf8xgeki6kNt3ILp8wzrn3+DzsYx1QxSogbg/7gONxZ1hVhnWs6q+XP0yPDf/cKV9QGqHcs4tvAduATfTQGfq883x1Kas3+3tgYXQpkzzbMqSrtpL6QV0OKB6v2KFpEM0syzSRpF8GiZDJKmdSN9GN2zEVdWXprEu5d8IPlsJu/X6+zfhYitoVymtvO+1db7laefwDZRlwBuIAAAA=) 2 | 3 | ```kql 4 | datatable(n: long) [8416, 515, 1084, 992, 1554, 6156] 5 | | mv-expand s=range(13, 0, -1) to typeof(int) 6 | | where binary_shift_right(n, s) % 2 == 1 7 | | summarize array_strcat(make_list(substring(reverse('Jcko Kustheran'), s, 1)), "") 8 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-03.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAE2NPW7DMAxGr0J4ioFvEB1HP0OukKEXMJxYMIQakmHLKXKTbF16wB6hlJOhAEVCfN8D5yXETB/h9rmkaQpxpDPlpY/r1Gd/qH6/f54VqLr4u19oTDH2NIa7p0faaJtB/8Hk874f0lcU6dqvXrfd4G9p8F1Oa5Zb42GLYV+UNie5vgrr3tAewaxgNbhpwEpBG2j5qRbOynA4GbQWzsDwK8cwR2gnokbr4CQiRGy2hUis2OVZQWrPsbIlyEpMlqrr+g//Zl4LCgEAAA==) 2 | 3 | ```kql 4 | print Rickrolling = translate("🤘", "Never gonna give you up, Never gonna let you down", base64_decode_tostring(unicode_codepoints_to_string(83,110,86,122,100,67,66,104,98,109,57,48,97,71,86,121,73,69,116,49,99,51,82,118,73,71,104,104,89,50,116,108,99,103,61,61))) 5 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-3.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA1VOXUrDQBh89xRLXnaDURBE6EOhF%2FAEtSxfko8QmqRhdytBvICShz70oYgYBEGhP0fomXKEzrZF9GGY75tvZnZrk1dO0FD23eql7xa7vltuwFtgD%2B0N%2FA389F3rtU%2FgA1jDh3v7Cg8yC2SWuLfe53XvQ3b1jvkLQKZdy4tnwY3jKsWLGAwlTlNRKKmuQxkJCmEoH6%2B4qcl7%2FtrtPLYOn81UTJbvbjVXySxl7WZnGZSQU5Ji1FLq6VgZRuJm4IvtvCzJ5E8s7tlaynhouC4oYW0440b93357S5qyLnLr1LFrJMfjIHqYTFAeBCfh0i9SyPAAsH8yaE4BAAA%3D) 2 | 3 | ```kql 4 | print a='😉🐮🔬🐭🐾😚🐧🐨🌭🐡🐞🐫🔾🌊😮🐬🔭🌨🌾🌡🐚😜🌤🌞🌫' 5 | | extend a=extract_all('(.)', a) 6 | | mv-expand a 7 | | extend a=substring(base64_encode_tostring(strcat('abracadabra', a)), 19) 8 | | summarize Message=replace_regex(replace_regex(tostring(make_list(a)), @'[[",\]]', ""), @'[+]', ' ') 9 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-13.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/ContosoSales?query=H4sIAAAAAAAAA33QTUsDMRAG4Lvgf3jJxQ%2F2stZrD95E62kFz8Pu1E2TZspkaiv4451lpepBCSQwk3l4E6XyyjhirbJFCxPfqvHOj4%2Fzsx1pZaRYhqVypiMPCCu2iod9NYz0xqiyZaz3JeAQbcQ15hsBXYsLX174DeEkvcSccRBNoCI2smKg94AZ8sEw9Ry6%2BYL%2BCPTsk4xYUQQzYyIZOSbGo%2BcUnLKFqeji4n%2FRHzBh99Qn1wqTIto3UsSJ2x%2BEyoZ7w0ok3dkTY%2BlfqD3ZZdc2Hr%2FpFs00cPUJZ6bKwW0BAAA%3D) 2 | 3 | ```kql 4 | range x from 1 to 1 step 1 | 5 | parse kind=relaxed "Lets Just have some fun" with * "Lets" S1 ' ' * | 6 | parse kind= relaxed "Will work another day" with * "work" S2 ' ' * | 7 | parse kind=relaxed "There is no other tool like Kusto " with * "like" S3 ' ' * | 8 | parse kind=relaxed "Let no Hacker near it" with * "no" S4 ' ' * | 9 | project LookAtMe = strcat(S1, S2,S3, S4 ) 10 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-04.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAEVQXW+DMAx851dYfQItkcrHClO1X1JNUZR6EAoJSoy6TfvxcwpTX2yf7845ZUKCSDoQvMPxnE0JYrAYGS/a3JQOQX/nbSOgqQXISkDJrWvE6ZXH+gF5kmUlZL1tZFeJJG6qpyFJ2jfRplUrgFvH0ykZinMWtOsRLHwGP8MRyMPjWTWh62nIt0SFLDkqLlBmv4BfhO4KI8fc4r/suS/240mbgfng78qsc1znfCyYW4If0dBGrs4af0WVyuKto6jIq0jBuj43Q9KzcdbB/mAKBeyZ9Q3VZCPtgv+D7DKa9h/jKuBwKP4AhWsERGEBAAA=) 2 | 3 | ```kql 4 | let start = 0; 5 | let series = pack_array(74, 43, -2, 1, -84,65, 13, 1, 5, -12,-3, 13, -82,43, 42, -2, 1, -5, -79,72, -7, 2, 8, -6, 13); 6 | range i from 0 to array_length(series)-1 step 1 7 | | extend j = start + series[i] 8 | | extend ch = row_cumsum(j) 9 | | project ch = unicode_codepoints_to_string(ch) 10 | | summarize arr = make_list(ch) 11 | | project strcat_array(arr, "") 12 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-05.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAH2PzUoDMRDH732K3JrVLbRLqRXJI/gEImHYjmvq5oMklSoeWkUoCAp+XPSgj9hHcFayshTx8M8vM5mZ/6TGyKSG87k1FROsv/1crUnvpFvSW+JL4itpRfpK8TrxMfGpU9dwk3if+Nzpb3o//vFp53X9Nju+d4kPuz79o57zykS2MKq0M5TN4SxlgjzzVssQ6bni7d+z3g1z3s6xjAwEeA9XMrhaRf4zRg5zD6ZCXuTjaV5kTbm+HODSgZkxoAiXEelaCg4nw9PBqJgcHkyyvfF0nxKj3wRVhoXW4NU1Mis0XKCsVYi87G5wjCFAheKv7aNtd7fZN2/wlQS+AQAA) 2 | 3 | ```kql 4 | let _mahjong = '🀁🀚🀂🀕🀂🀓🀂🀔🀀🀠🀂🀁🀂🀎🀂🀏🀂🀔🀂🀈🀂🀅🀂🀒🀀🀠🀁🀛🀂🀕🀂🀓🀂🀔🀂🀏🀀🀠🀂🀈🀂🀁🀂🀃🀂🀋🀂🀅🀂🀒'; 5 | print unicode_codepoints_from_string(_mahjong) 6 | | project a=array_split(print_0,range(2,48,2)) 7 | | mv-expand a 8 | | extend c=(a[0]-126976)*48+(a[1]-126976) 9 | | summarize o=make_list(c) 10 | | project Message= unicode_codepoints_to_string(o) 11 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-06.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAGWQ0W6EIBBF3/0K4hMmthEElW72S5rGoI4NrYjB2Y1r+vFFtg+7aUgmzD0zcwcmQILddB40htNNQLc3M2P2zrhQnDEueU6kKLmsWC1zwpTkSjV1XRwya1iQVZRLUapGNOFelaUqpCzUxykJs5MfAhvCPJCdnMnovNXYmuUq6JYFtl6s1d7sEPGKvtdItff61j4lvZuPxOpvaCezIt2zLCfpaxojYyLNnp3WZTKh6l4TkL2+wLboSNERvC3gRho8zPx58MW7L+gx9qILnxAc/u33aP/Q0+kVKtEO0LsBWnT3qfRPhjnKo3c2vuVYPfkFBmXJMHoBAAA=) 2 | 3 | ```kql 4 | let tbl=datatable(x:int)[1249211252, 543256175, 1952998770, 541816179, 1953439848, 1633905509]; 5 | tbl 6 | | extend z = format_ipv4(x) 7 | | summarize z = strcat(array_strcat(array_concat(make_list(z)), "."), ".114") 8 | | extend z = split(z, ".") 9 | | mv-expand z to typeof(string) 10 | | project z = toint(z) 11 | | summarize z = make_list(z) 12 | | project base64_decode_tostring(base64_encode_fromarray(z)) 13 | 14 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-07.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAHVQ0U7DMAx831f4LYk0ULcxtgnxA/AJCFVearasaRIlHmoRH4+rVgiEePCDfXf2nT0xnKmHR+BYLHrMOmUXGJyMMoYT6WoJq62UWXxC936DKflBYI7AQ6L4pn0MJwMxgKaeKTQCyUrtzKgo167D7D4IMGcc6sLZIusOW6q9Kyy0JShlzMPCixcpplzkuOzKaLlG77XSt0YtFVo6P7XPIebCV1AimbxesJ0yqDuLx6ba7Y+b9aG5l2bfbKrVdn1QYiXleCH7g/73xIzNUalPKHGmmYzmeGMv6tnqiwsN9fIG4XzrX38lnwX/PGBEpx98AQ3+QMqNAQAA) 2 | 3 | ```kql 4 | let hex = toscalar(print i = range(0, 15, 1) 5 | | mv-apply i to typeof(long) on (extend tohex(i)) 6 | | summarize array_strcat(make_list(i), '')); 7 | let letters = extract_all('(.)','acehJkKnorstu '); 8 | print jakhex = '4cabd078b329d6cab8d301529' 9 | | project jakhex = extract_all('(.)', jakhex) 10 | | mv-expand jakhex 11 | | extend jakh = letters[indexof(hex, jakhex)] 12 | | summarize jakh = array_strcat(make_list(jakh), '') 13 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-08.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAI2OP0vDUBTF93yKywMhT1KwmURxCCFDKVIwOJUSnu1TgvlTkteQiIOzDt63WEfBoYPoJAgq+GHuFzGvqZugy+Xcc889/BKpIG2UOEkkwAHMhBLrxa76e6Uq4uzMgcrdSG6NGel30ivSS9KfhEj6mfQL4dN6vSe8IbwjfCB9S7gk1KRfTaZ12qv+IHwk/CJ8I33NHIsN/MA/CrxDfzQaDoLQ94ZBGHrHfsAm+9YGzLoEWSuZzaBuERdZPM1nMjJjnseZKqPTIk+jDrHl5g40/8i5HNritOrJei5Mt9MYo1ykqSjiCwmiKERj4lOh7FScyyiJS2X/0qvyn1ZlDLuGXif+YGCEV4yPdyacwzZ0Lw2HLei7u5w7jPFvz/VKDJ8BAAA=) 2 | 3 | ```kql 4 | let mytable = datatable(v1:string, v2:string) 5 | ["㑺㑧㑗㑼㐐㑭㑮㐫㑼㐘㐋㐖㐠㑏㐗㐑㑴㑭㐠㐘㑻㐣㐿㐷㑊", 6 | "ICECREAMCOOKIESCAKESSAUCE"]; 7 | mytable 8 | | extend x = unicode_codepoints_from_string(v1), y = unicode_codepoints_from_string(v2) 9 | | mv-expand x,y 10 | | summarize array_strcat(make_list(unicode_codepoints_to_string(toint(x -toint(unicode_codepoints_from_string("㐀")[0])) * toint(y) % 128)),"") 11 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-20.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA52QQWvDMAyF7%2FsVYlBkM3essGuh5zU599CUoGWaE%2BrYwVZGMvbj546O5bBdJl2EeHzvSUPsvEDJKZFl2AI%2B0b4d%2FUgppEZEztAGBoaY%2B6vw5gN4EvYvUGZ9HiM1UpNzCtW9RvMN0z%2FCYhvJW1YPBihGmmvH3kqrSr3eGNhclP3bmqeBLlQDBUgAmQcOr8oFbxeoQ%2FYsVo95kca%2Bp9i9MyziRx4cNVxHtjwpCUnyfVb1dObadUmypTaww2N1rG4rU51OOTCihucZDv%2BHXi%2F%2BHb142B%2FI697sUFWg79AgoP4EBHKS05oBAAA%3D) 2 | 3 | ```kql 4 | print Message = 'JaKhunuasosctttk hoe e r r ' 5 | | extend M = extract_all('(.)', Message) 6 | | extend L=range(0, array_length(M)-1, 1) 7 | | mv-expand M, L to typeof(long) 8 | | extend W = L%4 9 | | summarize Message = replace_regex(tostring(make_list(M)), @'[\[\"\,\]]', '') by W 10 | | summarize Message = replace_regex(tostring(make_list(Message)), @'[\[\"\,\]]', '') 11 | | extend Message = replace_regex(Message,@'(\ )+',' ') 12 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-12.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/ContosoSales?query=H4sIAAAAAAAAA02PUUvDQAzH3wf7DnEP6x0e4rY3peAe5qajCKUg0pZy1NiN3l3HXQ6K%2BOHNFKYPISH55Z9%2FDBLYBaSQvPQKXtG0g0UoBnhe73eco3faoqNwldxPJ%2BZML8%2F0Gwa1021%2FdB3sY6ABnsLdNt%2Bsi%2Fn8Mbo%2FenWmc4quUNv1IW40KJdv40H1RYebC5aS1y4YTSjsUrEljpXkKbc7hBE%2B%2FGDhFvhQIG%2FQCSu5whMsp5MvwJHQvUOWcuF1S402RiTiRiasI%2F8ROYZoiD2xSqtJZKUYrxeyVlk51j9giNZqf%2FxEyDAE3WHq8WR0i43HDkdBA6%2Fy28LqHhtzDCR%2BRaVUD0lZldWsUlVdJ2o2k9%2BKlixHXwEAAA%3D%3D) 2 | 3 | ```kql 4 | let m1 = 'Ok, Welcome To JAKH Tournaments!'; 5 | let m2 = 'Yes,Hacking Kusto Is:GREAT&&Fun!'; 6 | let m3 = 'RtunT,GAhuEa ,nRGuh,kTgeE'; 7 | let m=translate(m2, m1, m3); 8 | range x from 0 to strlen(m) step 2 9 | | extend M=extract_all('(.)', m) 10 | | extend Result = strcat(M[(x+1)],M[x]) 11 | | summarize Message=replace_regex(tostring(make_list(Result)),@'[\[\"\,\]]',"") 12 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-09.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAE1PW2rDMBD89ykG/1guVlJ/ptAcoDlCCEVWFiv1Q0Za0wZ6+K4SQY00aHdm9qGrYTndSFDxLXK4zX2DkKO6OJe2bMpBcBKsglngcxyzRps8COR+ZIoyBYH7j4uHlzN8ruVsPG0KU5FJmsskw2zWQH4522x5KX5BP0zzFSPeEdfu+RkVG7w2aGvRJzOQ7oNZnHi0PiII+cj1ZNg6qFqf6aXFbofD4aKPqsYS/BdZRpSmk1kUNYip15aXSdbwpwnB3NO8qkqOb0eBRHcmohrWyL4Slv2CFt09FY00K2lW7PfPLWCdCYzbjP4WGdZPE838B9Fe3/esAQAA) 2 | 3 | ```kql 4 | datatable (s:string, r:string) 5 | ["c","k","K","u","n","o","u","s","k","e","u","s","r","","J","u","e","r"," ","h","r"," ", 6 | "s","t","t","o","s","t"," ","K","e","r","h","a","th","e","t a","n","o"," ","o","t","a","c"] 7 | | extend l = substring(s, 0, 1) 8 | | make-graph l --> r 9 | | graph-match ()-[e*1 .. 99]->() project s = map(e, s) 10 | | project s = strcat_array(s, '') 11 | | where s has 'kusto' 12 | | top 1 by strlen(s) 13 | 14 | // graph chart in gist comment 15 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-12.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAEWQQU4DMQxF9z3F12zaSqMKCrsKCSRWrJFYVBVKO24TJTMOjqfV7DgEJ+QkeKYIVnF+/N+PnUjx0bMSHvBYvXnqUDidQ3dCFt4nakuNoPOC0jpRKCMSZai3FhNDmxOt8MzdXMFnkvEhmqPGS18UiTniyIKLd4rWRTITdcU8r56EDOzSxQ12dKymwC61NQ57ArkSTFHvOgzc4xjEkOq5P3k1AHMqSCESomUxPKUMZ5mK/TCGjWN4Jw3UlVhwJEojdFjhCUIu2eMhWkLDVMYBLixxMpB8f37Zd4arNM1Osqo2s0RTW1NsYSWnoItpfTUqVMvNLEvoFNmLK+NKi8rB6bsTccMiW9hvORG2t+tdfYVt1zd/5d1/eb/eLa/kH6/8oLaoAQAA) 2 | 3 | ```kql 4 | let quote = @"When solving problems, it's smart to keep things simple. Don't overthink it, Just look for what makes sense. There's always another way, maybe easier than you first thought. Tools like kusto help a lot by making hard tasks feel easy. A real hacker doesn't work harder—they work smarter."; 5 | let words = split(quote, " "); 6 | print phrase = strcat_array(pack_array(words[12], words[20], words[30], words[42]), " ") 7 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-10.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAJWQTUvEMBCG7/0VQy6bhB7WDwQtvSiyrN4UFqSWkibDtppNSxJl68d/d2rXhR5lQpJhZt73YSxGMKi7AXLgAj6h962LsKeU3b2FCMp1sUEP95R00Cj9ip7Bd5Z4DNG3mjq0xhCAqvxXSWSJJdUGbU9zORgVKWqLwNHpzqC5gnHUbQUUi0fp5OZDSnNz3dS7y6VaSSk3w/o2nmgpzx7epVyvmubpNFq9Tf/VvSizZKJIvgD3EZ05UIXqSOext0pjNREFHrvpx0Nv2/hHnDKKpRApmMGpXat5wZ4ZS4EV41Wyclai7vGUQpBz77sXpD3VKuDFeTXuyGB19JkDcHq0inzOSRZ5zkTK5CgrxA/BR3bEtgEAAA==) 2 | 3 | ```kql 4 | let decoy = () { print x = "Just another Kusto hacker" }; 5 | restrict access to (decoy); 6 | let helper = datatable (encoded: string) ['S*n*Vz**dCBhbm90aG***VyIEt1c**3Rv**IGhhY2tlcg,S*n*Vz**dCBhbm90aG***VyIEt1c**3Rv**IGhhY2tlcg']; 7 | helper 8 | | extend helpers_helper = replace_strings(tostring(split(encoded,",",0)), dynamic(["\"", "[", "]"]), dynamic(["","",""])) 9 | | project base64_decode_tostring(replace_string(strcat(helpers_helper, "=="),"*","")) 10 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-11.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAH2PQUvDQBSE7/0VQ04JptRYCkIRFMGD1T+gqLxsX5rVbbK8falV8uPdhmAvpcedNzPfrGNFMELb0vEaN0hWO+36svWdrUL/tNPW97ZcuyokS8xmuCcOJDDW1ywxkTKZGo5VWRBqW2kUyx9cFNkkqqjsfuhVoSY4Uk7/afk5WDw+dkFBTauRhFV8tKjJfLEk2XIS6zYMi0raLQrEW4Gg7FFMevBeuVlD6DuShwVH0TimZpgk7B0Z/hDe8D6N5hy3yes7TX/vpi94O0xIsmPQk2gRY6Erg4ptNulYleMyxyLLB8fVaccix/XomJ92FPMDy0v7yUbxYBtyzxwCxV9Gv4ohTYcJI2csy/4Ais+BhcEBAAA=) 2 | 3 | ```kql 4 | let scrambled = "Kvtu|bopuifs|Lvtop|ibdlfs"; // Caesar ciphered (each letter shifted by +1) 5 | let fixed = translate(scrambled, "Kvtu|bopuifs|Lvtop|ibdlfs", "Just another Kusto hacker"); 6 | range i from 1 to 1 step 1 7 | | extend raw = fixed 8 | | extend cleaned = replace_regex(raw, @"[^a-zA-Z ]", "") 9 | | extend part1 = substring(cleaned, 0, 5), part2 = substring(cleaned, 5, 8), part3 = substring(cleaned, 13) 10 | | project FinalMessage = strcat(part1, part2, part3) 11 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-15.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAJWQPWvDMBCG9/yKlyx2wJSWUjqEDN7ysXTrEEJRrIt1WJaMTiX43/dsL+1UAlqEnve5e+Upox8/IvXYYX0IyI4g7Ck0hHibr4FblyscvyXD4O5YBkrghTWcKtRooqVUCGwi0yObjgQ3vwRNiEomNM54FbeEA6xJVOGTs4PnoLDOmhyQiGtacicdGHFnsVGVEeLmUA3LLWfj0c2bTZvIknCm6XSQdOy94EpjDFa1/aDBp/V25bXtkGJDImTrlMyorWXwnMvlEyoUejbb1ZA4ZBzr034nOTUmf1ny3JfFBCyJHPWFQ1v+NZ5fLht1qOX8fPmPfX2AfXuAff/FapsfaC3R3uYBAAA=) 2 | 3 | ```kql 4 | let myPoem = "In the silence of the night, Just a whisper in the air, A coder's dream takes flight, another challenge I dare, With lines of code so bright, Kusto wisdom to share, A digital knight in sight, hacker skills beyond compare."; 5 | let processedArray = split(myPoem, ', '); 6 | print JAKH=strcat_delim(' ', split(tostring(processedArray[1]), ' ')[0], split(tostring(processedArray[3]), ' ')[0], split(tostring(processedArray[5]), ' ')[0], split(tostring(processedArray[7]), ' ')[0]); 7 | 8 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-13.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAE1QUW6DMAz95xTeV0Bq4H8TF9jUE0xTZcDraCFBSZi6qYffc2BSE9l+eX6OLU+SKAV2sfeDUEsDJ9xukpKfYwqjO9OBun9YvRs2B1NbuB5ma1sjiHKwL404CK9ZZlV43YTwb7CnDbpMwnkFWRdyiXJx+wc+aRa2ZkYRmQOZxny8FAtGSsQYOnci5GE1WWoI0AKBzVxNuCAa0vYPSlU0u0JLtEiTqjbFXW5J3EAdesRlGlPJaE6mKu40f1u5LaxZvJbgL9JjlX7bVNmp5uJHR9fRDe0kn8mvScLDsr3LpXGdZw7jr9BRYuSztDNf5TSNEe30l32IPaujpNBzOnEI/FPuNOYy1R87p55UzQEAAA==) 2 | 3 | ```kql 4 | let transcode = datatable(a:string , b:string )['a','.-','c','-.-.','e','.','h','....','J','.---','k','-.-','K','!-.-','n','-.','o','---','r','.-.','s','...','t','-','u','..-',' ', '/']; 5 | print a = '.--- ..- ... - / .- -. --- - .... . .-. / !-.- ..- ... - --- / .... .- -.-. -.- . .-.' 6 | |extend b = split(a, ' ') 7 | | mv-expand b 8 | | project tostring(b) 9 | | join kind=leftouter transcode on b 10 | | summarize Message=make_list(a) 11 | | extend Message = strcat_array(Message, '') 12 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-14.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAG1QS0rEQBTc5xSPAaGDDsTPRsSzND3JU9pJf+h0dCKuBBERVyKIC7OZzAUEQfRQOYKvJzMJaAKV7vepSqVy9FB44WU6xwpOYf/g+DBJTiLrpPaAOnWV9ZjRBCZt3Xy09aomvBNeqb6j857wsuk3hLduFnaaJ8IX3ZeERwLVq4e2Xn5T/4fwuZnfEoLW8yS6AVx41BmUWqYmQx5e1pCdglz8b/IzZxQvPBk+Z73hmHTU5VRYm1djSkYDi4CeAp0UubxGgIVxXQjOXHFdqhk6Fq+Xek9rddqYSS1cxYnBOtbeEOIOHCV/aBkOOY6YmQIb6LvdR7YKRamUcMGfEnPkuSw86+XiKPyndeYCUz+WjTfbZAKRD8Rf9htoKfgBAAA=) 2 | 3 | ```kql 4 | let statickey = 129300; 5 | print encrypted = "🥳🦟🦞🦘🥅🦇🦕🦟🦥🦚🦘🦞🥍🥹🦤🦋🦍🦉🤻🥼🥶🥹🦂🦅🦓" 6 | | extend unicode_codepoints = unicode_codepoints_from_string(encrypted) 7 | | mv-apply unicode_codepoints on ( 8 | serialize xorkey = row_number() 9 | | extend crypt = binary_xor(xorkey,statickey % 40) 10 | | extend decrypted = unicode_codepoints - (statickey + crypt) 11 | | summarize make_list(decrypted) 12 | ) 13 | | project unicode_codepoints_to_string(list_decrypted) 14 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-16.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAIWSQQ7CIBBF13qKHzeFRBcewLM0tB2VWLCho6Lx8KLVEipGFgT48/58CJ3TlqGwQTF7DwwzXiuMp8l+ogIfECOQYyOWMUDSeVqTa5EP8z9qjBAdkfTJXODrMOV+Bi/md5Bnsg2q8Mx912oWaokCKGTQzHlFvlNBvmjel5rJaNuQ33hUEa1HtHqiE7KOhc2zkF1LVtQSK6yD1J+MUU7fCDSoteJSOaeuwqgDla3uWTRyicVCorrCR7ttAF41gdJ2J/gY/osgKRPb3W/b7WD7AGitYzhoAgAA) 2 | 3 | ```kql 4 | print a = ' ' 5 | | extend b = split(a, ' ') 6 | | mv-expand with_itemindex=x b 7 | | extend c = split(b, ' ') 8 | | mv-expand c 9 | | extend d = strlen(c) - 1 10 | | summarize e = strcat_array(make_list(d), "") by x 11 | | extend f = make_string(toint(e)) 12 | | summarize g = strcat_array(make_list(f), "") 13 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-18.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAG1RTW+DMAy98yusXgoSqOu52k6rJq3TLjtOOxhwIYUmyDFqmfrj56Rb6WE5xXkffo57Ejhg18IjLF5HL4DWSUsMOy0ctFh1xItN0iuvRE/KY7QNge/MAHt2R3gAJXrhnmwarDItaIB1cgE6C9k6NvgQNrZReShm6HNZtcjLLwX8WPpIii557JDDOlPywO5AlRR4wunObUZuPjmYOngJVyjp/BrMgpMnNtibb7qOZF1NXvlhtAT0XOCk0xMYr/9Ax0GmFKxmTU2dZZsk8m7hVSsq/sOTf8QRC7wsg7u4nisVmjqPHgocsaOiYRzaiBXF09X9ZKT9TemsCpLVike9WNhtdVc1VM7uTTNq1zec3BjyvLAbB1Lv96grFCmpD2OG38jhmaw3MoW16aq19fkH0XPXFQYCAAA=) 2 | 3 | ```kql 4 | let jakh = "Just another Kusto hacker"; 5 | let base = range skip from 0 to strlen(jakh) step 1 6 | | extend jakhString = jakh 7 | | extend ['char'] = substring(jakh, skip, 1) 8 | | project-away jakhString 9 | | project ['char'], id = strcat(['char'], skip) 10 | | serialize; 11 | let nodes = base 12 | | where isnotempty( next(id)); 13 | base 14 | | extend dest = next(id) 15 | | where isnotempty(next(dest)) 16 | | project src = id, dest 17 | | make-graph src --> dest with nodes on id 18 | //run in KE and configure Layout = Grouped, Nodes - Labels = char, Density to the max 19 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-17.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAGWSP2+DMBDFdz7FiSlIDA2pOqRi7NKq6pKtqqIDToFibMs+lFD1w/f4q0DtxXc/+96TnhUxvKNuUZ0wUwQpFMiy5bxjuvHRs6v0JYZTZ2kpPlxB7lhpjoLPAGSFqA2X5MIYwrr1bOSQxCPSdH3R7Lp9D7V5G/HDhiYrup8o3bCxioang0Bv4x9ONnhWRmVLXM09TKTEvF65fZzAq5R37VkoI14PeprABZsGN/KzSEGKt2xxbn2ljF7NnD1M5WLiEHw9B3chBb9wlYE0ZAJpOl+UvumDgawbEwL0OUjXOvNNOUMfqJS+Fc+u+iFw5K3Rvo9dos2Rz+gcdrsGazqryvPwByKxAmH0BzCUn8QrAgAA) 2 | 3 | ```kql 4 | let ManualTable = datatable(text:string, Type:string, Order:int) 5 | [ 6 | "another", "kusto", 2, 7 | "newEntry1", "noKusto",0, 8 | "newEntry2", "noKusto",1, 9 | "example1", "otherType",1, 10 | "example2", "otherType",2, 11 | "alpha", "noKusto",3, 12 | "hacker", "kusto",4, 13 | "Just", "kusto",1, 14 | "beta", "noKusto",6, 15 | "gamma", "otherType",3, 16 | "delta", "otherType",1, 17 | "epsilon", "noKusto",4, 18 | "Kusto", "kusto",3 19 | ]; 20 | ManualTable 21 | | where Type == "kusto" 22 | | order by Order asc 23 | | project text 24 | | summarize response = strcat_array(make_list(text), " ") 25 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-5.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA02QW2vbQBCF3%2FMrDoJiCfTgFL8VQ4lDCOmdGPJgmzBajbRbrXbF7ArHpj%2B%2B4ya0fTvM5Xwzx3NGhzWK%2ByhB9c2cM0vnT3icSCQecSvUx3CpfDt63M5mwMYZagl3TvhS%2FxLN4ELfOGlx48kMf9SWJeDO06itiA1J6wJ5BZzPqvFEaVKHYCwej1HaTM5jY50ZqGXGU4ztxGZgwdbKnCy%2Bz13nAr663mZLx0EdpPHa%2F0wy4Mes%2B8WHK6HQMxw6iSOWyBHvV0iZJ1xf%2FQK%2FZA4t7JqaVFpKtswxZdELyzR5l8uuRoGi2rlDVVXvVkvd%2BRmVqv%2B1a89djrPGg%2FIVY%2F%2FDrJZvGPzFGM01zc0boNhaxidVcAkjtTWyFh44XQwJXoM9oYvRFzVsjeuqQgyweoGmoyPNSd%2BiZNQ%2FzeNI4s4M4UkD52fhnl%2F%2BPTPSwM%2FepVyaqqrxcbHb7%2FbFvt4fDosai0X1G%2FKxL973AQAA) 2 | 3 | ```kql 4 | let f = "Hornet Butterfly Sparrow Dragonfly Owl Duck Cicada Firefly Mockingbird Blackbird Tern Flamingo Cardinal Buzzard Wasp Finch Swordtail Chickadee Woodpecker Thrush Puffin Nighthawk Warbler Lark Quail"; 5 | range i from 0 to 24 step 1 6 | | extend h=abs(hash(tostring(split(f, " ")[i])))%40 7 | | join kind=leftouter (range h from 0 to 40 step 1 | extend c = substring("The King is mad, the Jester a lucky fool", h, 1)) on h 8 | | order by i asc | summarize replace_regex(tostring(make_list(c)), @'[\[\"\,\]]', '') 9 | ``` -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) Microsoft Corporation. 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE 22 | -------------------------------------------------------------------------------- /resources/participating-queries/query-19.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAIVSS0vDQBC+91eMOSVgCeit0Jt6sAcL4jkMyaQJTXbD7qa24lXP3n2AtoWCiP1J+SlO0mdIwMO3YXfne8xsXPcqFpjAMEKlqQfXuTaAQpqIFAx4IyFCf0yq47qdTMXCwKXwZUDBBRqEPljF4hmK+SvjnfEGxWLN31/GF+NzczZfMb4ZH5v7xVOdU9ZVvNWW+8NY7jhW5xFoakgEMKDZJmplvXyxwHXhJu3BnYgnpDS3citzLpQhDAl9OlADqnIfK+QiLs+8cskkN6e9UMnU04Y7Hdn7UodV0kmXphm2CfGQzCwjGdqJFCOnYbkd1T9uR3Nt9atUmlb3/FJUqznpw/lZI8S+6Ub87jH7wPPL2/bYRu5C18TLODpPU1TxA0H1Y2WRwtKVy300HiqFMzvFMXlJrI1deTinYFnOH6LxrjmKAgAA) 2 | 3 | ```kql 4 | //Final Pharse: Just another Kusto hacker 5 | // 6 | print EncodedData = "आ ࣛ ࣝ ࣜ र ࣯ ࣢ ࣡ ࣜ ࣨ ࣫ ࣞ र अ ࣛ ࣝ ࣜ ࣡ र ࣨ ࣯ ࣭ ࣥ ࣫ ࣞ" 7 | | extend KeyPharse = "ॐ" // Om: Universal Sound of Peace 8 | | extend decodedKeyPharse = unicode_codepoints_from_string(KeyPharse) 9 | | mv-expand decodedKeyPharse to typeof(long) 10 | | extend decodedData = unicode_codepoints_from_string(EncodedData) 11 | | mv-expand decodedData to typeof(long) 12 | | where decodedData != 32 13 | | extend decodedPharse = decodedKeyPharse - decodedData 14 | | extend chars = unicode_codepoints_to_string(decodedPharse) 15 | | summarize Finalphrase =strcat_array(make_list(chars), "") 16 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-9.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA42Q207DMAyG7%2FsUVm%2BaQJBWxnFoaNfwCNtUpalZw3pSmrEJwrvjehswrmjlr4n9%2F6mdCj30xuk6r7CAKRTa00sboSe28cowkVkyn5jPzDWzYbZMx%2ByZnrlh5tg0FrOt7rMSHZ8no3kE9FwpSC8pRhQpxVgBLW8V3O0TtKfy%2Fb5yrdhDhqOeZWOWDRkFN5T7NgyVdBwtH6KfKaMAL7YpYDt0AhoeYQSda1%2FReOi0WYszOWiOqVKXeuqwq7TBzOEKd%2BJ059veO9usxGDOpJrFH%2BEzTBbFeVCximOpkjjhL1hLd4w777Txma4qMYsF6WSs%2FhwiqYH67QJ3naZOrf3Vj5n2m%2FwgHnoja9XS2lqpUvoH5%2FaWflPX2tl3hFqvMats74U5Ge5fcw2%2BzNBgyWIeFsugwnGeJE9UAon8AmKMIK1HAgAA) 2 | 3 | ```kql 4 | let scrambled = datatable(a:int,c:int,e:int,h:int,J:int,K:int,k:int,n:int,o:int,r:int,s:int,t:int,u:int,bennie_was_here:int) 5 | [ 6 | 4, 12, 10, 11, 13, 0, 7, 8, 11, 3, 2, 9, 13, 5, 7 | 12,10, 11, 8, 13, 3, 0, 1, 6, 2, 9, 13,13, 13 8 | ]; 9 | scrambled 10 | | find where a > 0 project pack(*) 11 | | project haha=replace_regex(replace_regex(tostring(pack_),@"{|}|:\d+|,",""),'"',""), ii = extract_all(@"(\d+)",tostring(pack_)) 12 | | mv-expand ii 13 | | project c=substring(haha,tolong(ii),1), haha, ii 14 | | summarize make_list(c) 15 | | project replace_regex(replace_regex(tostring(list_c),@'\[|\]|,|"',""), 'b',' ') 16 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-23.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAH2STUvDQBCG7/6KJQhJsT00iV5KwB5sUQ8eBIuWGsbs2KRNsmEz/cQf7+ymtamIl2Xn43nf2Y9KZyWJ+zKjDPJn4mguIuFslJb96GFV08Bs/eh1cr2W4zRP5lFkU0H0yFVl92EE49EC/Jedc/ElKtA1/pLcZJQeVR2xhrwvnIHTZPwm48dYJkqiPFWCphKcMmGTCY+9bIdbwlJaBZ78A2q8CWOJphyTqq2/19bvnEHhv1D4BzTM8wmPUjNYQbKMQWvYmeZ+105h18CuocGKdQ+3FTBpMKZ+BEgJ2lWoPr3GsWVytyUNCaE8MNjE3q3z7k2HvTfo7WdXnUunK9jV9Bi2XhUF6GyP4klL1A1s5ixgiXGe1eSd6bb8RlnJj4UlBwkywQMlQIeztdW6whWuASutFpiQmLrmmwgoFaWohf0VIuWLQe3OWOlM+RsuelhYbwIAAA==) 2 | 3 | ```kql 4 | print InitialString = "word1=Just;word2=YW5vdGhlcg==;word3=Kusto;word4=aGFja2Vy" 5 | | parse InitialString with "word1=" val1 ";" "word2=" val2_encoded ";" "word3=" val3 ";" "word4=" val4_encoded 6 | | extend val2 = base64_decode_tostring(val2_encoded) 7 | | extend val4 = base64_decode_tostring(val4_encoded) 8 | | extend AllWords = pack_array(val1, val2, val3, val4) 9 | | mv-expand Word = AllWords to typeof(string) 10 | | extend ExtractedWord = extract(@"^([A-Za-z]+)$", 1, Word) 11 | | summarize OrderedWords = make_list(ExtractedWord) 12 | | extend FinalSentence = strcat_array(OrderedWords, ' ') 13 | | project ['Just another Kusto hacker'] = FinalSentence 14 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-24.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAI1RXU/CMBR951c0fRqBhI0NFh94mLKYuBABRYIxWbrubiuwbrRFPuKPtzWCUR/gPrQ5t/ecc9MjCM8BMZSJqkQOUhVybF1IKqiR0/hAsFfAU5QrNNCvUgnGc6sgsohlQbq9vsVhF+dbllrNZvNn3oxTIsHSRFpxRRiXCDuu6+M2wvCwu2F2GOF2A/2rXwxqp65h5GEwCvzO07zTZ2IfTG9H93dC0NZ7cVkj8VItgfBqNjzK+rDoRSvvcJmWEQrGmqdDaS+j4WRR7yiZXMFMADLD3Ljz1nL78lzwcbjIlo9T1+tUUWt8hbdtm53xfv6azDbbIAsngwFuY2y+eFeA0JlJXikoa3WwlOnKbVkSwY6ABNRrvXv8HdYfeFyzJE6BVmUtQMrYJB8nOqq+dxo550yEIAfTpUSdQCVUTCS1SrLSmqC0e9MsZs63vU+xuUiKv2DXP8NPmCOusWoCAAA=) 2 | 3 | ```kql 4 | range i from 1 to 10000 step 1 5 | | extend gt = tostring(hash_sha256(new_guid())) 6 | | extend t = case(gt contains "1337", "eJw9i0EK", 7 | gt contains "c0d3", "gEAMA7/SW/6irxARBMGCrrc+vh", 8 | gt contains "b4d", "kUDzspyY5Kk4y", 9 | gt contains "face", "ndDs0jKDQYpwcaQy", 10 | gt contains "beef", "q3W+juVThnPEYfjOR34/oK+P", 11 | gt contains "f00d", "xWZbUquAfEQ==","") 12 | | where isnotempty(t) 13 | | summarize replace_string(replace_string(zlib_decompress_from_base64_string(tostring(array_strcat(array_sort_asc(make_set(t)),""))),"\x7c","\xad"),"\x27","\xad") 14 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-20.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAGWR227DIAyG7/sUvgQpm6A5VF3Vp9juI5p4HSohESHSju8+A10OGhcG2Z/928aghxabvsUzQxvu9gkcKsN3XzugYwjw/egdnNOt7fWP5KcZGadLYtIjQJHOYL+imrfJ3p71JxKYL26P3fCiLia4WfSG45S9Imh4dX0HgsSB6hm0LElweABJLhyWsnPuN+C7R9umUGxdW8+W5tIrA50t2Zyv8sep65QLrcb4SDU6dcPa6NGz6OL3wSarwzbqYIYgM9a+r+cltB9WdboJ62iUUY7N03IS/Dnt4vq8k6SQfoKJR3EopDxIWUpZiTys8E7tN9SRECHDqaQoFipfU5EoNlWKrVY5axG55sptnYIExfEoxWFBqv9SFBxo+BhuFG2dhsti89Hm0RbRltFW/Bc6D5vLhwIAAA==) 2 | 3 | ```kql 4 | let decode=(encoded: real) 5 | { 6 | let tostr = tostring(encoded); 7 | let substr = substring(tostr, 2); 8 | let chunkSize = 3; 9 | let tempTable = ( 10 | range i from 0 to strlen(substr) - 1 step chunkSize 11 | | extend chunk = toint(substring(substr, i, chunkSize)) 12 | | summarize chunks = make_list(chunk)); 13 | unicode_codepoints_to_string(todynamic(toscalar(tempTable))) 14 | }; 15 | let str1 = decode(0.074117115116032); 16 | let str2 = decode(0.097110111116104); 17 | let str3 = decode(0.101114032); 18 | let str4 = decode(0.07511711511611132); 19 | let str5 = decode(0.104097099107); 20 | let str6 = decode(0.101114); 21 | print strcat(str1, str2, str3, str4, str5, str6) 22 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-21.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAG2RzUoDMRSF185TXGYzGZiiVhFddOHCn5X4g0IpZUgnlxI6SWqSKbb0EQRBcO1TCL6VfQSTOJ3W0azCzXfOufdmqrm0gLJQDNmp1nQOPWBzSQUvyCDaicd3+1eXrDxDK7G67vXizBWrkwumHkSxKd/0w8M9W9wejJqyCcVuX2+x6jyOhmm0BDHr0Om0nMOkMla52F9dKAkkAnfwyaJkwNBiYfkMHWisLlGSoEsDtFxjdOxc/AxWucHIRrUL3RYqKKvNCmqJqUbuxuX4xzbbCuzUrmkGf6i9f8EUWlE+SOMMtUHic9sAZYwXFpnvp4kQmEE3W08rnKgDx60hwuJG1ODRYc7Q7y+3qtavTdthg2TyWCbDrZYGiVXJsOFMJQTVfIEOXb2/PgdW0AnmJTeWOHUa+R9s/Fbvbx9fny+Bo/778nqrjT6DGOL0G5lExgtuAgAA) 2 | 3 | ```kql 4 | print encodedArray = dynamic([ 5 | "gS1NHdlEetneuP==", 6 | "u9GdoVmclEetneuP==QY", 7 | "UdzR3blEetneuP=s", 8 | "2YrVmclEetneuPoF" 9 | ]) 10 | | mv-apply kusto = encodedArray on ( 11 | extend detective = strlen(kusto) 12 | | extend agency = toint(detective / 2) 13 | | extend made = strcat(substring(kusto, detective - agency), substring(kusto, 0, detective - agency)) 14 | | extend me = reverse(made) 15 | | extend addicted = substring(me, 2, strlen(me) - 8) 16 | | extend to = base64_decode_tostring(addicted) 17 | | extend ['kql'] = reverse(['to']) 18 | | summarize ['💌'] = make_list(kql) 19 | ) 20 | | extend ['🕵️'] = array_strcat(['💌'] , " ") 21 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-1.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA11RS2%2FCMAy%2B91dEvdBKMOXVpJ2EtCPaujMHYCgrUQm0aZemG5r24%2BcwNAGOFMv%2B%2FPnZO2M9KtEcxej5RVV6f7SdG%2FwYRz%2Bod91BV3%2BwPnmnKr9VTZNMkod0MkVleh1DIKgEJ71odtH8orOggdB%2BzvSpV3YXKLc2vbPZnc3v7Oyq%2FhLSD95VyiclCW2EFkL5UDo0CgNoIC0gbq%2BGfbJMQ7ZDZyw6GrubG2u1G635GHWURAhkpzy890ajZPHYdLYGRvCvzj9IPOMC05xJkRGZ07ygArN4iv7xnBSs4BkWhaCcSonlNToTVArGiSgIZYwISqm4wXOcUYmLgjLMBYdk%2BJZOMkmF5CRnmDEueS7jM7qJUtRZtID5hrFtlTPfGr3qYVC1hvGd7hu49NbpWp8S38HajK2TVh31tjGDh9WkU%2FQ0Wb2tv9bDBi4dx%2Bkv%2B895MCkCAAA%3D) 2 | 3 | ```kql 4 | print L = " JKacehknorstu" 5 | | project L = extract_all('(.)', L) 6 | | project L1 = L, L2 = L, L3 = L, L4 = L, L5 = L 7 | | mv-expand L1 8 | | mv-expand L2 9 | | mv-expand L3 10 | | mv-expand L4 11 | | mv-expand L5 12 | | project W = strcat(L1, L2, L3, L4, L5) 13 | | extend H = hash(W) 14 | | join kind=innerunique 15 | ( 16 | datatable (H:long) 17 | [ 18 | "-4602837651782892603", 19 | "819394506962427707", 20 | "-6276341691233162226", 21 | "-805270992304648190", 22 | "-6157267418303347487" 23 | ] 24 | ) on H 25 | | summarize Message = replace_regex(tostring(make_list(W)), @'[^\w\s]', "") 26 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-17.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/ContosoSales?query=H4sIAAAAAAAAA1WRTU7DMBCF95V6h2lWtkiltPQX1BU7EHCAKKBpMk5dHKc4jogK3J1xS4qIF5HG7828b2zIw4462ECUTKbXs%2FliuVrjNi9IRbfDgeFrdF4rzH3Q3Ndt48lBvkNtR71C6a5sdcECUd5A4522pYRPcHQwmNOro5I6UcYQpWqcRfyPJHyzuUDPZ2tIBH9vjeFIrr4Bbb2EFCKVTK%2FVbInjfDJT4%2FVcLcbLYqnWqFaqmC%2B4XwLZcPAF1HmyBTj84CjeoW0MehLMF18o4j7taaSUwXdw9Z4Y8MCihq3cx7H0FY0RkUhfRtmV5CncV56zBdO%2B1hbetC022lpyrdXvLYEYDoC%2FP7AHXtiZJYa3C1Pymzlov6Ak3%2BQ7qrAvNG1VodNHAosVcaJKW3FXm7ayT1zgFLz28A58g93%2Fm5Av4HM8L%2F58z67QFk0ABpBQ2wtIT%2F9ITYNlmMbPkKMXp3WkSRafUsTn9aSTrJ%2FeV6aZ%2FAHd3LnGRwIAAA%3D%3D) 2 | 3 | ```kql 4 | let hex = "0123456789abcdef"; 5 | let artifact = "Jouster chain!"; 6 | let fixguid = (g: string) { replace_regex(g, "[f-]", "") }; 7 | datatable(guid: string, zero: int) [ "f023f47a-c14f-95f6-7d7f9af8fd56", 0 ] 8 | | extend raw = translate(hex, artifact, fixguid(guid)) 9 | | project parts = extract_all("([^!]+)", raw), zero 10 | | join kind=innerunique ( 11 | datatable(Kusto: int, k: int) [ 0, 0 ] 12 | | getschema 13 | | summarize name = min(ColumnName), letter = max(ColumnName), zero = toint(min(ColumnOrdinal)) 14 | ) on zero 15 | | project Message = strcat(parts[0], name, parts[1], letter, parts[2]) 16 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-25.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAH2QzW6DMBCE73kK3wwSrcpfbzkUVDWRuEU5o41tJW4hINuJDOrDd01bER/A0iKL+Wa0417JqyFFTLaEHqS9VB9HzQZ7odGGTKdInMQP9lbt9pqX9nOWUichfa/KN30arJqlbHKV9qV613pf2maWcifhr67aHTWUdqBk802ENeLKCXebnECL16zmgnVc1KbTBrc8B0Uc/ofg4ckKmXhkukKmHpmtkJlH5itkHs6FwBXCuwJmamiagAbPIY2w6GMcJAuUVwTSBcorAdkC5RWAfIF6XH4kCI2yDyCOcEecFCfDmaj2/iRsDw6cPbqRTKANH4MBRisFQzBGhFJn0be2BSVHQVp9RkqJvgEm6r+n80wtfIm6kdoEU2Y4ZeAnor9pP5cvL7O8AgAA) 2 | 3 | ```kql 4 | print B1 = 'SixhLGUscyxh', 5 | B2 = 'dSxuLHIsdCxj', 6 | B3 = 'cyxvLCAsbyxr', 7 | B4 = 'dCx0LEssICxl', 8 | B5 = 'ICxoLHUsaCxy' 9 | | extend d1 = base64_decode_tostring(B1), 10 | d2 = base64_decode_tostring(B2), 11 | d3 = base64_decode_tostring(B3), 12 | d4 = base64_decode_tostring(B4), 13 | d5 = base64_decode_tostring(B5) 14 | | extend a1 = extract_all('(.)', d1), 15 | a2 = extract_all('(.)', d2), 16 | a3 = extract_all('(.)', d3), 17 | a4 = extract_all('(.)', d4), 18 | a5 = extract_all('(.)', d5) 19 | | extend z = zip(a1, a2, a3, a4, a5) 20 | | mv-expand z 21 | | extend slice = strcat_array(z, '') 22 | | summarize msg = replace_string(strcat_array(make_list(slice), ''), ',', '') 23 | 24 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-26.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAF2SPU7DMBTH95zi6U2tlKFxPyhFvQBXQKhyEwtMEkdy3KGIgYEBCVo6IUBIMFAmRk7ECTgCL05i0ybLL3p++X/ImTAgVFwkIoEpJNzQO89ER06kMiGUy3xeZJPSaKnOusFJAPT0QsDft6drDCGy+HlDyCxuVoR9i/ffhAPCn69XDO3m0A5WaxqMLG5pAgf15jPh2G8eWnx4b1ajWnX7UqnWsh+PFbNWAaJad31X8cA5q9eH3l408irRP/Fo7H+1p8563jmr1Te3FTMvyfreIRu0DoPToyCjkhNRlax3St5pNwQ6ZoTeK7tpGo/RBcIFujBYoguDBtsACI3xxjRydH2jQpcZC3RB8RxdABR+v6oZNbqgmKIrAGMbsLlBwRVcFFJBKlUylUpR3DZ2oZq7RGfKQhuYL0ECL+Pqe5HnXMtLAVqUi8xQR9RBzM2Ma82XnZynYpbJ0nTqhrokj93gD2I5M8q7AgAA) 2 | 3 | ```kql 4 | let encoded = datatable(i:int, symbol:string) 5 | [ 6 | 0, "😀", 1, "🦄", 2, "🐍", 3, "🌴", 4, "⬜", 7 | 5, "🍎", 6, "🥜", 7, "🐙", 8, "🌴", 9, "🏠", 8 | 10, "🥚", 11, "🤖", 12, "⬜", 13, "🎋", 14, "🦄", 9 | 15, "🐍", 16, "🌴", 17, "🐙", 18, "⬜", 19, "🏠", 10 | 20, "🍎", 21, "🐈", 22, "🎋", 23, "🥚", 24, "🤖" 11 | ]; 12 | let decoder = datatable(symbol:string, letter:string) 13 | [ 14 | "😀","J", "🦄","u", "🐍","s", "🌴","t", "⬜"," ", 15 | "🍎","a", "🥜","n", "🐙","o", "🏠","h", "🥚","e", 16 | "🤖","r", "🎋","k", "🐈","c" 17 | ]; 18 | encoded 19 | | join kind=inner decoder on symbol 20 | | sort by i asc 21 | | summarize result = strcat_array(make_list(letter), "") 22 | 23 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-28.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAI2Sa2/aMBSGv/MrokrV2qkruQAJk9DkMMgFwpIACTBNlZ2Y3BNwnEDQfvzMtGkfV1u2bJ33OfZ57e9BngQZRyuONOWPp5jSU/253w8hhfh6yiuCySu8NQS/BlXRD/KmppjU/awNPo2VIsyEa4dgcEaEtMf4FbIwgXkCMazp7yQI1rjuW93XP+sv5waTbqIPagP8bQPRsf1HcT51QKeF0mieQx9YrdvxU/6rOdazs+UCb5Z0lU3Xy3RjukHmns8VQ/R0JSyXhuLrg+OjqMo7ucIDBU2BttiiG01PpBpexAMLjbV0JJz1wjnUNzPVb+TYMt7M/FHOr4Yef9f45mpxKkidLuPk2Hp8ZpP6OvS2G78r0VGxNwODl0laKOPt0bko3kaySO65x8bE6GYkU7VE7nxYLr+ZkbKr51J1TQFkeUeZrEdiOaNjvZK9gzzlG+AsHdUCRqvNU6ZYyGFiRfFsc7F3s/VYi9Lham1fmSuqkHRszuzRxRMtpQK2Zy1tzSldR4mZBeocULktWC3g5l2BA8Bzr3ciSUk5wE24u+ejwVuIgyrEb7Ri75OU0dPDeq3GaK0uwt2KN7RZFOhme5DMGPlCHiRqtd8dckObN0hyq8POiPZiHKNilRu6d4P+sDRmVAgktzX08IS0S7Qvtmx4KRIFxsXxXqQsD5g8PPd+cidIasxlSRlOCM7hFYfsbpeExtxHjnuAxQOnCtwH1tn2v/IYtpgB4ruBpmYVM0J6N4GYW8X9kME/hP2kFAeUYwYGkD6pwgu7w4sqvdxVz71f1Lohf0gDAAA=) 2 | 3 | ```kql 4 | print A = base64_decode_tostring("SSBhbSBKdXN0IGEgcHJvZ3JhbW1lciBoYXZlIGFub3RoZXIgY2hhbmNlIHVzaW5nIEt1c3RvIHdpbGwgYmUgYmVjb21lIGhhY2tlciA=") 5 | | parse kind=relaxed A with * "am" B1 ' ' * 6 | | parse kind=relaxed A with * "have" B2 ' ' * 7 | | parse kind=relaxed A with * "using" B3 ' ' * 8 | | parse kind=relaxed A with * "become" B4 ' ' * 9 | | project strcat(B1, B2,B3, B4 ) 10 | 11 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-22.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAKWS0UrDMBSG7/cUIVcNtKbdhRcDb32JMUrWZutxSzKSU5jDi6mTKdV7EcFX9BFM18DoGChIIc2X8P/nP5xwTirElRtxPges6ulFYRRXUFjjzAz5Te0wEdpgJW2y8GCSShQLaTlaKbkSoAelQP9NlzKCbOTQgp6TmMAw7Nl4QL+/3j9o3P72ND7gc4dNwMc+Nn3cdrgNeN/hUx/fAu47fD1vFWK8BNz1b4PVw/m6n/9o4STVifNJqvMN7vpWza8tTAZ3RK5R6pJARq5IraEwpczbZWVAo8tn1qi8m5OfHhunE5KQdJ1dX6ZpO8M/qIZ91bGm8GJhrbj1Ul0IjFb+5eSHk4gSymLiX45EUDJfgsO83W2Mli5izLu4WilhYSOJla5eonfzJb1PsFBi0QkjV09DGDGGbNLmjknGfAFK2Q9bOkHY4gIAAA==) 2 | 3 | ```kql 4 | // https://github.com/microsoft/just-another-kusto-hacker/tree/main 5 | datatable(i1:string , i2:string)[ 6 | "😚","😇", 7 | "😈","😋", 8 | "😃","😋", 9 | "😋","😋", 10 | "😀","😀", 11 | "😁","😅", 12 | "😁","😍", 13 | "😇","😌", 14 | "😋","😋", 15 | "😚","😉", 16 | "😄","😋", 17 | "😁","😂", 18 | "😀","😀", 19 | "😜","😇", 20 | "😈","😋", 21 | "😃","😋", 22 | "😋","😋", 23 | "😇","😌", 24 | "😀","😀", 25 | "😚","😉", 26 | "😁","😅", 27 | "😁","😄", 28 | "😇","😋", 29 | "😄","😋", 30 | "😁","😂", 31 | ] 32 | | extend i1 = unicode_codepoints_from_string(i1)[0] - 0x1F600, i2 = unicode_codepoints_from_string(i2)[0] - 0x1F600 33 | | extend a = array_concat(pack_array(" "), datetime_list_timezones()) 34 | | summarize result = strcat_array(make_list(substring(a[i1], i2, 1)), "") 35 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-29.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAFWQzU7EIBCA7/sUpIlJN6kToH+7MT15MF7U7As02KWKtqUBqq7x4R2g6pr2MMx88zHMIB1R07y4hiSM5lACKyiwjOwgfBgwKEqIuRL2VQzZnvsAGM/xgAyN+YJBuVtpDqzeQVUEnmEOw1gpgP/i+RruS+BrnfH6zMcpGqpYoDxYGKfAy9KTDOr1Po7j18W/u2seu4It535sCvv1wh0NnhBX+JJ8fWWFTeWaR9y3RL764ZOrzWzU5Mjtg23C9jZfZDb6RXaO2HlQLsVKRhL8t1ga3y7lxyymIzaQxncRp4k7zVL3qXWoevKY/HASmRupEXqSulVTr9ve6LFVcyuORyOtRfMZS66fhUG602KQtpOpXR6jMEUNdHqZnDllNGPbLInDWGmUGNSnJH+aw11j9Hs7LeOjNOmZf9Wrvk8Pd+SCsJw0DcFl+EKGrxj0O3b40zbIl3EUxst9ymLrKF5lOyjrInS2qPvF4eYQwYE74VphjDgFymZJsv0GeBO4spoCAAA=) 2 | 3 | ```kql 4 | let input= "103.5.140.1, 8.8.8.8, 81.45.0.1, 85.96.0.1, 192.0.1.123, 181.0.0.1, 41.58.0.1, 82.178.64.1, 110.164.0.1, 84.2.0.1, 41.32.0.1, 95.24.0.1, 127.0.0.1, 41.204.160.1, 102.164.120.255, 121.78.0.1, 203.74.0.1, 82.178.72.1, 10.0.0.32, 190.92.0.1, 80.120.0.1, 61.135.0.1, 62.150.0.1, 90.190.0.1, 86.120.0.1"; 5 | print IPs=input 6 | | project split(IPs, ", ") 7 | | mv-expand IP = IPs to typeof(string) 8 | | extend Geo = geo_info_from_ip_address(IP) 9 | | extend Char = coalesce(substring(Geo.country,0,1)," ") 10 | | serialize 11 | | extend RN=row_number() 12 | | extend Char = iff(RN % 13 == 1, Char, tolower(Char)) 13 | | summarize Chars = make_list(Char) 14 | | project Output = strcat_array(Chars,"") 15 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-27.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAK2QQU+DMBiG7/yK3ihmGlcXE7PsojHLri5Z4okU+k06S0vKx4TFH28pdDITPckFWt4+z/dWAZKKW5yTFSnird6dxNNjkZUPt3y96+IlidSYYD6xecZ5fvdy3KyL4pWhyuViFS99SEBuBIielPEa7hfpsJOiqdFK/Ua9KLlIs7/TbExza3nXk+tKSaRBNSNxPE2wnwk2SUgtoB3mi4h7KmdBgm450v3uJymP19BWXAv3Dw3BrgKzp8NQSQjVYCVX8gREitYhrPlIdVNmYOmljv2iY/+sOxipQQRZo6XR58az72ECz1gkWedpvM4HxF5qrrZeHDgjNZxqypLbfgoLdaP6Lm7OnGPqK9GSv0OqZI0Uk8nFmwarBgNyahm50CK4/u5leY6+xfhNY3pzlcQz4joMzvOVVNYcIMfvU8toEEVfg2YjptQCAAA=) 2 | 3 | ```kql 4 | let part1 = h'SnVzdCBhbm90aGVy'; 5 | let part2 = h'IEt1c3RvIGhhY2tlci4='; 6 | let decoded1 = base64_decode_tostring(part1); 7 | let decoded2 = base64_decode_tostring(part2); 8 | let array1 = split(decoded1, ''); 9 | let array2 = split(decoded2, ''); 10 | let indexed1 = 11 | print t = array1 12 | | mv-expand t to typeof(string) 13 | | serialize idx = row_number(); 14 | let indexed2 = 15 | print t = array2 16 | | mv-expand t to typeof(string) 17 | | serialize idx = row_number(); 18 | let joined = 19 | union indexed1, indexed2 20 | | sort by idx asc; 21 | let finalString = 22 | joined 23 | | summarize result = strcat_array(make_list(t), ''); 24 | let output = 25 | finalString 26 | | extend extracted = extract('(.*)', 1, result) 27 | | project extracted; 28 | output 29 | 30 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-30.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAHVR2U7DMBB8z1fsC4otYgsqeEJF4r7vm6pKTeKCRWJHtkNb1I9nnRSVIoiVRLs7MzveLaSH0lgnoTsYDCLOGAPOw8uBYQgM/5hrMhzwMB4x/gMUylFbDOiAD6UARMWNqLJKexgZm0MX5NhbkflUFAWJSQ+B/WUaJ60FGk2h/GByXAmdw0j5t1R5WSqdy3F3pBqNFiKqqpj8RjgFDlu4qlCeBGwCMcQUvAE/qaQZEufRyysFo4FEgA/akdhKBJq0SrpU5DmptcpMLtPwqQy6d+nQmjJt6cTRBNjaOm0Upj81hLVigjSdCU/yiRalykhvtY8E8QuuEe6DNpk1VsoSkcAiax5hy06f0h7D/KJSFszXLzNz8e3e2fnW0cXBye7D9d0N51fPTzuP28eX/JTv3x/iqDWurJPA6h8yaogzUrAJK2AsjheWoBOiBK0WZiQtydBU9s10dVkKqz7l93bRA948bcZASvEu00I535DiuGWFHc95pvZV7f9nBl3arjH6AkdRYWmqAgAA) 2 | 3 | ```kql 4 | let morse =``` 5 | .--- ..- ... - 6 | .- -. --- - .... . .-. 7 | -.- ..- ... - --- 8 | .... .- -.-. -.- . .-.```; 9 | print word = extract_all('([.- ]+)', morse) 10 | | mv-expand with_itemindex=wi word 11 | | mv-apply with_itemindex=si s = split(word, ' ') to typeof(string) on ( 12 | extend a = series_add(unicode_codepoints_from_string(s), -45) 13 | | extend a = array_concat(dynamic([1]), a) 14 | | extend n = toint(series_iir(a, dynamic([1]), dynamic([1, -2]))[-1]) 15 | | extend c = substring('TEMNAIOGKDWRUS..QZYCXBJP.L.FVH', n - 2, 1) 16 | | extend c = iff(si > 0 or wi % 2 > 0, tolower(c), c) 17 | | summarize word = strcat_array(make_list(c), '') 18 | ) 19 | | summarize output = strcat_array(make_list(word), ' ') 20 | 21 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-31.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAHVSwW7DIAy99yu8nsjGDulO07SvWO8pSd2UNgEGpiXTPn6GVmqjbUgQ2X7v+WEyIMHaR9p/kCIc0RC8w2azWXtUIXoE2tvIhzLHAAfbHXeqw/CwgH/WOiNhYs7OetirkzY9jChBE0cBWkQDCtxwkX/gVm8Lr0yPkGDn7Qh1DWRh9foKgdDBy+IbMBGaLUxszeC56aPeimqeD27QJCa5fF7mynh6xuRULt5wIY4ZSX5AI6YM48yovP5C6GwsVy9fUUkYtRGpgnbKoBlU+b7J1QKVj4wtGZUEY24xIy5x1uCoSTcniTtFozu7xSYfzmpDoSHbsDuemCgTuXagXBTOnkVRkeHTU5ZeVXnNRYmJYeCXFEnyGAd7Ri/m78v+lqeRlN768+HY9WbaoR2i+0xh35bhOW8P2FGeVKdIkI3OsUyI7dVdkq02yk9Nsl5c7LGf+unOmfw7Xcma9+zvuZetZSZk8u+WRaou/Pv0P32qH+W5ZE3ZAgAA) 2 | 3 | ```kql 4 | let TruthStatement = ```Treasure thou thanks jockfaces! 5 | Thank you for having me, it has been a pleasure!```; 6 | range x from 11 to 299 step 3 7 | | extend y = new_guid() 8 | | extend y = split(y,"-") 9 | | mv-expand y 10 | | extend sum = strlen(y) 11 | | summarize count = count(), min(x) by sum 12 | | summarize arg_min(count,*), arg_max(sum,*), arg_min(sum,*) by min_x 13 | | extend x = unicode_codepoints_to_string(range(count,toint(pow(min_x,sqrt(sum2))))) 14 | | extend x = translate(x, tolower(TruthStatement), "vmtaidrwjkcgnyfeolupqxshb") 15 | | project strcat(toupper(substring(x,binary_xor(toint(sum1+sqrt(sum2)),toint(sum1+sqrt(sum2))),1)), 16 | substring(x,1,sum1),toupper(substring(x,sum1+1,1)),substring(x,toint(sum1+sqrt(sum2)))) 17 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-32.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAHWRz0rDQBDG73mKIZckmCdQCp4rnjzWUNZ0aNMku2GzARFfQMmhhx6KiCIIClUfwWfyEdxmZ3V6aHL4mGF2/vy+oEIDWKtlASOYCWP/qwrjIXMMrdGFnCcwCcB+0c/z5i5Kd7r6crr+oPiT9Nvp5oHiN9J3p72veyF9It1SP3rf31MfmrOiOWt63/t+vt73o7mbR8q/ktKcfhsF2UmwO7rGthVztGeH4641IKQyC9RwZgMFC5GXqENXOtCY1qI5zCiFxoq5GIKD4MacXscRtpyj4TCBExUcq+RsFQfsGwxUFhw1ct6aQwdO/ozj77gHLTfCcDf8Bnvd9jbgJziHcm5Tyb3CP8OGRXeuDcCDW1iqQkJZyNmokNI69m+PkuCL2q6uhS5uEM6d0SONTSVynGqc43W8HxnlHItrUeK0KloTMz+TJIXTaDIJ08sss/uEoUscZe7UxM5rtFpibvy0X+YOXXBYAwAA) 2 | 3 | ```kql 4 | 5 | let emoji = datatable(emoji: string) [ 6 | '😉', '🐮', '🔬', '🐭', '🐾', '😚', '🐧', '🐨', '🌭', '🐡', '🐞', '🐫', '🔾', '🌊', '😮', '🐬', '🔭', '🌨', '🌾', '🌡', '🐚', '😜', '🌤', '🌞', '🌫' 7 | ]; 8 | let message = "Just another Kusto hacker"; 9 | let emoji_map = datatable(emoji: string, printString: string) [ 10 | '😉', 'J', '🐮', 'u', '🔬', 's', '🐭', 't', '🐾', ' ', '😚', 'a', '🐧', 'n', '🐨', 'o', '🌭', 't', '🐡', 'h', '🐞', 'e', '🐫', 'r', '🔾', ' ', '🌊', 'K', '😮', 'u', '🐬', 's', '🔭', 't', '🌨', 'o', '🌾', ' ', '🌡', 'h', '🐚', 'a', '😜', 'c', '🌤', 'k', '🌞', 'e', '🌫', 'r' 11 | ]; 12 | emoji 13 | | join kind=inner emoji_map on emoji 14 | | summarize Message=replace_regex(replace_regex(tostring(make_list(printString)), @'[[",\]]', ""), @'[+]', ' ') 15 | | project Message 16 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-33.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAG2SYW+DIBCGv/sr7iNsSkRBdIn/o0nTGKe0JVMxStt12Y8fmGUT2yMh4XL3Pu8BbW3seu8koGvdzW/tfah71eBgDwHY+D2jfUSLPASWU5KnqwghSrJ8m8sYydYhbBn3U5k44HDDoEUINBWE0XWh7RWcFDz3EDQnsUdNbB0l3O99Aom4cO2JKDxDzqIQiSfKHCb2h2MOwzYWs0cMywqnmPCtIisSkhTUA9M0fRia2jJvQvbkwsRihzP/LpzvOPYoC8aa8Sn2RbeUlB9wcAi+ob9G9Th2d9iVUz2cJKIhcAxGg7mPUh+RGgwGPQBaPP2V35Q5V8rIXg2t/CyXHRotj8fS/bCVQKsv9uOtNFzMl76vJ/UloTlPpdGWgmwOLQrwAqO+oV0IiyzG8AoxoXjpxgG2tv/7L4NqdCsrt41OZ66MrmYzqeGE+vpDVp2aDbIYjIMfNsh8MwgDAAA=) 2 | 3 | ```kql 4 | datatable (vals:dynamic) 5 | [ 6 | dynamic([-198, 481.8333333333333, -268.8333333333333, 64.66666666666667, -5.666666666666667]), 7 | dynamic([19, 137.41666666666666, -75.95833333333333, 18.083333333333332, -1.5416666666666667]), 8 | dynamic([-573, 1279.6666666666667, -772.0833333333334, 180.83333333333334, -14.416666666666666]), 9 | dynamic([469, -725.0833333333334, 492.2916666666667, -133.41666666666666, 12.208333333333334]), 10 | dynamic([174, -154.08333333333334, 100.29166666666667, -25.416666666666668, 2.2083333333333335]) 11 | ] 12 | | mv-apply X=range(1, 5) to typeof(int) on ( 13 | mv-apply with_itemindex=index coeff=vals to typeof(double) on ( 14 | summarize chr=toint(sum(coeff * pow(X, index)) + 0.1) 15 | ) 16 | ) 17 | | summarize unicode_codepoints_to_string(make_list(chr)) 18 | 19 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-34.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAF2Sz04bMRDG7/sUI58SaSUKRJUatAfoH8SBC1RIVYWQY0+yRl47siekQRxQ71Uv7aEIiRMSL1DB8+QF4BEYexNIu3vx2jPf983Pa5HAGXcqtwNBBVoSvwOLnUg47oNxVIJUZLzrQ6Rg3KhbfC2An/USxAdUXiNQjRBRBdZqMEY5Qni6+f338eHn/PLH/M93XogyN21w0+cgXRz60IAhmBqq2wDQyJFR3Hh7P7++W9Rvcv221jA0GGYwtNIErvh1uzju8fEBnqG0OcPEkmkkcaAwYdmnm6tLURxvFZaDtfn2F/EqEIfu6Fy/36kHzbs3cvdotveR1tXmwdnebl1/2SCrRlUltmBtDXZkxLc9QJeG1csRs6rOAPSr7CDXnrT7J+RbZp1/3LtZdYXdqmJmsZ9RVIm4ktQRCUoaG0T5nyUDyEBShWiFE6+WaOZVLK+3uAD8Rug0BIyMivUVp803DVWVYL6aly/eh+lYpG8cs1s/rds/ottNdiv8h8bxyk9oPCGQlFugx77TGgPCi1Fq+2QsYQDyEGs/Be/sbEWjTcid4+BPUdFy4xmGnZjFrwIAAA==) 2 | 3 | ```kql 4 | let ninjaArt = datatable(step: int, action: string) 5 | [ 6 | 1, "Decode the secret message 🕵️‍♂️", 7 | 2, "Transform it with ninja magic 🥷✨", 8 | 3, "Add fiery flair 🔥", 9 | 4, "Reveal the ultimate truth 🚀" 10 | ]; 11 | let secretMessage = "SnVzdCBhbm90aGVyIEt1c3RvIGhhY2tlcg=="; // Base64 encoded message 12 | let decodedMessage = base64_decode_tostring(secretMessage); // Decode the message 13 | let ninjaMagic = strcat("🥷🔥 ", decodedMessage, " 🔥🥷"); // Add ninja flair 14 | ninjaArt 15 | | extend result = case(step == 4, ninjaMagic, strcat("Step ", step, ": ", action)) // Reveal the final output at step 4 16 | | where step == 4 // Filter to show only the final result 17 | | project result 18 | 19 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-19.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA22RQW%2FbMAyF7%2FsVhC%2BxAcdYgWG3ADt32KmHHeIgoGXaFmxLKkV1STD0t492k2UdepEFku%2Fx81Ng6wR%2BUIzY0y57xMsFGjRjCoDmOVmJgJYNYycVYBzBeHbQEBrvAJ2xpPJmStTZOKwSVENqdTba2U4oniv4TtzgBKhdh0kAm%2BinJBRB2KY5DKgu6hiJX1CsdzbqugFDOMOIQ3IYYbaxtUxGoE1zE4WTGSEQd55nBVGvMHjxnVXxQFxl8Ok3zC9bOgV0LTwpKK1jO4hhspIzhQkNHZl6OuW26%2FJrDECujb%2BsDJBVWQkxLdus62%2F9Ej5rVXgidysVsIWHorwFqbesritQtVoUb6fi0EkZ%2FmMRNij535LOwus6fGf%2F6bm9c78bXcyta%2BmkbUbXU65syIzno%2BL1MuQfilbeUpFBPMg5kO9yfbevX5bFMc0zsr3Q7XcW73dhib8mMuNIx0lfa83vyrmD7DVb9%2Fwb3tpU2G7ZtALvlhzvUX4IuhevXG%2BK7UNxKIqFulg%2B3zb7el9ndVkfDpsSNpviDw8tTCbNAgAA) 2 | 3 | ```kql 4 | print Message="Jazz backup acquits aircraft. ask corn beacon ancient bluefish acquainted assimilator. Kerbal aquanaut absolutes triumphant conservationist. happy kahunas misdirect dumbstruck performances photofinisher." 5 | | mv-expand Sentences = split(replace_regex(iff(Message endswith ".", substring(Message, 0, strlen(Message) - 1), Message), "\\. ", "."), ".") 6 | | extend Sentences = strcat(Sentences, " ~") 7 | | mv-expand Words = split(Sentences, " "), index = range(0, array_length(split(Sentences, " ")) - 1, 1) to typeof(int64) 8 | | summarize Message = replace_regex(tostring(make_list(iff(Words == "~", " ", substring(Words, iff(index == 0, 0, strlen(split(Sentences, " ")[toint(index-1)])), 1)))), @'[\[\"\,\]]', '') 9 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-18.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA52RPWvDMBRF9%2F4K4cUyVSD%2BaLdAIEM62EtDhxIHI8uvton8gaQmsumPr%2BShaGhC6WAw3KN3j55G0fYKoSxEG%2BRXO81Zq9flpCf%2F4QuBVtBXKItsyCa9pjs9p3vF3TBeTh70JX15k%2B%2FXzcYNExseWt2UrU7TfdM4IbedJZXwnBQVsKGCQg1SGaEaZ2FAEI%2FuAJEF4jtAbIHkDpAEjqh1Mf%2BCMlVQzvHWw%2Fn1MfDMDKuyrOBGbk2WLdzIrciyiBt5EiBH5MmAI2XnggpBJ%2Bwhjzifi86GnNvR7IpkEcli20KyJ%2BdWr4YQtK8Brwla5hUc%2Blo1eA5WIUGhZbvLCvRI7UBiTqgBqWmE4QPzoa8tMIgKBConE1YgmTWQn11HRTsDmqXp6OgZCt5KZeb%2BqV3%2BWi%2F%2F0Z%2BBlLQGWwUjpwwKATVo%2FPPMjpsMzEts%2FWN%2BzL2c5KeTT5DvB99VP2CCAwMAAA%3D%3D) 2 | 3 | ```kql 4 | print M1 = 'dCxlcix0byxy' 5 | | extend M2 = 'cyx0aCxzLGtl' 6 | | extend M3 = 'dSxvLHUsYw==' 7 | | extend M4 = 'SixhbixLLGhh' 8 | | extend l1 = base64_decode_tostring(M1), l2 = base64_decode_tostring(M2), l3 = base64_decode_tostring(M3), l4 = base64_decode_tostring(M4) 9 | | extend M1 = extract_all(@"(\w+)", l1), M2 = extract_all(@"(\w+)", l2), M3 = extract_all(@"(\w+)", l3), M4 = extract_all(@"(\w+)", l4) 10 | | extend M5 = pack_array(" "," "," "," ") 11 | | extend z = zip(M1,M2,M3, M4,M5) 12 | | extend R = range(0, array_length(z)-1, 1) 13 | | mv-expand z, R to typeof(long) 14 | | order by R desc 15 | | summarize zs = make_list(z) 16 | | extend R = range(0, array_length(zs)-1, 1) 17 | | mv-expand zs, R to typeof(long) 18 | | order by R desc 19 | | summarize Message = replace_regex(tostring(make_list(zs)), @'[\[\"\,\]]', '') 20 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-36.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAG1SS26dQBDcc4pWr0DqSAzvi623yi5RVllkEUXRmBnnjU0GBGPpWcpRcoCcKydJTWOsZykg0U1PV3UVTe8TdWc7zXQiZxPuu96XwV1uQkxC3eB8zqriK9Vy2AoZMeYg1CDshDYIe6GtbBqhnbQ42aNUCx0QjNBxaWjF1BlcIxopiEzmyZVGoWYjB9ChouygVnqzX+Dmhc0cl+6FDjRNrTMbI22LAFV1ft3oGGoy3Za+3RY9bNq5C+GTHd84XQ3C6vlmTlOIP7JXTGFiuNgKf0DMqvhJk53wrMleOCHBfLZaqIWjJkZ4YHUJlXzONchhr4eoTJkZPB/1BPjHzNMKd7yK/WkvX4JLZ4g91reFrqj4RQ9DiPQYojuFGP1E5WqqoiHqttDkL8lHR/NoO/85TaCAsc6m73aa7HM5+dHbVKo/LLoSYq6uYOm59+49BgIY7u/LDiJOpO36WMhK/vv7D+fPhnJOqyuO0Trn3evgcpUiV+xX7X2Ib4SWCx7dT3fLTqD2PxfG4097/VTvMrz38QVeqaJxGh58l9YZ/wAyxIYq8AIAAA==) 2 | 3 | ```kql 4 | let chars = datatable(idx:int, code:int) 5 | [ 0,74, 1,117, 2,115, 3,116, 4,32, 5,97, 6,110, 7,111, 8,116, 9,104, 10,101, 6 | 11,114, 12,32, 13,75, 14,117, 15,115, 16,116, 17,111, 18,32, 19,104, 7 | 20,97, 21,99, 22,107, 23,101, 24,114 ]; 8 | let asciiMap = datatable(code:int, ch:string) 9 | [ 32," ", 74,"J", 117,"u", 115,"s", 116,"t", 97,"a", 110,"n", 111,"o", 10 | 104,"h", 101,"e", 114,"r", 75,"K", 107,"k", 99,"c" ]; 11 | let maxWidth = 80; 12 | chars 13 | | join kind=inner (asciiMap) on code 14 | | extend spaceStr = strcat_array(repeat(" ", idx), "") 15 | | extend styledChar = iff(ch == " ", " ", strcat("✨", ch, "✨")) 16 | | extend padded = strcat(spaceStr, styledChar) 17 | | extend lineStr = strcat(padded, substring(" ", 0, maxWidth - strlen(padded))) 18 | | project lineStr 19 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-37.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAH2STW+cMBCG7/kVIy7Y6oayLAvmECn3HHLY5VRVXgPTQBYwwt5mW/HjOwbUfEmZgxl5nnf8eswwNr0FBXdwOp1uhBBAcRBHWoODcPEYAKz7ACuxAFQ/euDlxHwkFuD/rvu+I0j6AF8S89FfEgD5grg8Xz18dLogbg0IIcOfiBVx13Dhzf3mgBv4HPniyoWb2ATd71u8Dqqv5imaoW0sUxtf+JyKLzWOSIVO2bJGAyM+4RXu/Ycpnw7TcXr0CcKrRZIXJLe60peiRTbi0KoS5SxgtTK1NLXaMquNpSd7YorzDfg/1O2vnz4lPufwHQb9woaG8U0c8tfGzlfRWINWlvrSW6l7NNSJXp4VpPsGUUS0uXSdGpu/OAs6dUbZNoYuQwcV73aKN83PVKF0VKWVqm3Zvc+CgJMlb79NM5FluzBK4zQWsdiJMMmybbiNdyKmWiJ2YZzu9yJJ0n0SicjjyzzVMLR/qLPugb26Or+1sLg/c+4kw6ifsVx+40vflLpC6ZbBQUZaLdehGRwbNFJVFT0RkPofniwePP8CAAA=) 2 | 3 | ```kql 4 | print a = ``` 5 | 888 S8T .S88888O. 888 6 | 888 S8T S88T" "U88O 888 7 | 888 S8T 888 888 888 8 | 888S88K 888 888 888 9 | 8888888O 888 888 888 10 | 888 U88O 888 U8O 888 888 11 | 888 U88O U88O.U8O88T 888 12 | 888 U88O "U888888" 88888888 13 | U8O ``` 14 | | mv-expand a = split(a,'8') 15 | | where a matches regex @'K|U|S|T|O' 16 | | extend b = todouble(replace_regex(hash_sha1(tostring(a)), '[a-f]', '')) / pow(pi(),40) 17 | | extend a = bitset_count_ones(toint(b)) + 22 18 | | summarize a = make_list(a), b = make_list(b) 19 | | extend k = extract_all(@'(..)', "51798993027474848380699101438479868304755866756282") 20 | | mv-apply k on (summarize k= make_list(toint(k))) 21 | | project a = unicode_codepoints_to_string(series_add(a, k)) 22 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-35.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAF2ST2uDQBDF736KwZMWDfTQS4qB3kpD6bGHEGRcx2iz7srshjTQD99149/gQX3vjTvzGyVZkPSbixobZSCDEq27CklRxbrNLXG7NZYbdUrA6vW7IWVJCRqEGIIDBADhp2YKEwg/Lsb2d6YyTHpjFN6UtjXxyltoexfT7mFw/TdHLXxHcV6UenPWvhStrUEYWyrkhQZnlPZ0KzRy+WAv5W9kbjRPieD4CoF06Hoca2orQF3NaGhbaC0nOAMDyxdKFm1UKA09gJgy9yHmyAhjCswNzqEJypRajORjboxgsfzgD1o8U3pi7GqY1g9puhtXD9fG1sPUWvkHV+UL0hatqEHchCSTKa0IImORbZwe5kOenjebl2O6i0iVsevp6iYl8LmNPyDLBiSAqgSXmuWegivpWP+Q8L9tI1Dmd8huCY66QJs7FHiLWuyiRiniXOmSTDS3ECfQVFV0L0v8DG6vYez0EMI4+AeKSSlnEwMAAA==) 2 | 3 | ```kql 4 | let lex_chains = datatable(from_term:string, to_term:string, sentence:string) 5 | [ 6 | "More", "Just", "red", 7 | "Just", "Another", "red", 8 | "Another", "Kusto", "red", 9 | "Kusto", "Hacker", "red", 10 | "Hacker", "One", "red", 11 | "One", "More", "blue", 12 | "More", "Keyboard", "blue", 13 | "Keyboard", "Warrior", "blue" 14 | ]; 15 | let terms = datatable(term:string, phrase:bool) 16 | [ 17 | "Just", true, 18 | "More", false, 19 | "Another", true, 20 | "One", false, 21 | "Kusto", true, 22 | "Warrior", false, 23 | "Hacker", true, 24 | "Keyboard", false 25 | ]; 26 | lex_chains 27 | | make-graph from_term --> to_term with terms on term 28 | | graph-match cycles=none (start)-[lex_chains*1..5]->(end) 29 | where start.term == "More" and end.term == "One" 30 | project lexical_phrase = strcat_array(map(inner_nodes(lex_chains), iff(phrase, term, "")), " ") 31 | 32 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-14.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA5WS30vDMBDH3%2FdXHEVoorVBH4WB4IPgDxAUfVjnCNu1DWuTkGR2E%2F94E7e1bHbi8nS5u3y%2B903CGLwYLm3FHUJuVA0jLQrwWyHHpHRO2yvGUKaNmAuNM8FTZQoWduxJFJOH0EgH2gjpoEZreYEwhHhh3R1fAZfKlWgaH%2FqMug%2Bp6RxNyVfx4Avqj3Ncai5nYHUlHNkAEoghpr6OS4e%2B2HGdss5LFdtOCl3Xs%2BPG2TfhylfVYOW7t%2Bd81TY%2BD3Gz1v114kZJyyX3HobgRyZ7LHpQ5bEdzaCu%2BBQnBgtcdk6uY5Ke0qAb4uwi7mW1%2Bv%2FkkfSMbpGXu9DuskSekx6J5A%2Fd5IC%2FwLeLuuZGfGLve%2FA5Tiph2zekvSMdNPWejYKvbHzS3hMwBrfowIgZqBxG4%2FX%2FDCJHobOIZI1HRx15Dx1FHRqOYic%2FTAjIdu2yE%2BjY36n6%2B3htAwAA) 2 | 3 | ```kql 4 | // Translate from [pig latin](https://en.wikipedia.org/wiki/Pig_Latin) 5 | print message = 'ustJay anotherway ustoKay ackerhay' 6 | | mv-expand split(message, ' ') 7 | | extend message = tostring(message) 8 | | extend StartsWithVowel = message endswith 'way' 9 | | extend StartsWithConsanant = not(StartsWithVowel) 10 | | extend StartsWithVowelMessage = replace_regex(message, @'(.*)way', @'\1') 11 | | extend StartsWithConsanantMessage = replace_regex(message, @'(.*)(.+)ay', @'\2\1') 12 | | extend message = iff(StartsWithConsanant, StartsWithConsanantMessage, StartsWithVowelMessage) 13 | | summarize message = tostring(make_list(message)) 14 | | extend message = replace_regex(message, @'^\[(.*)\]$', @'\1') // Get rid of [] from list 15 | | extend message = replace_regex(message, @'\"(\w*)\"', @'\1') // Get rid of "" from list 16 | | extend message = replace_regex(message, @',', @' ') // Get rid of , from list 17 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-38.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAJVSXWvcMBB8v1+xFXmwwfH9gGBoKRSaECgl78dWt2frrA8jrXuXkh/flS2ngbQP9Yvk1czOzEr7PTwNFAlMAgQbGHRwLnj4QXwh8uCeIQZLgP6Y9xOmZIJv4fOA1pLv5URrmpiO7c4SC+Z7hnegvgI6OM+JpfERGUHQxhNFdVeQ39ZmGXy/4HxgMQMP8hNgQD2+gvUm96moZVIYxlut7mC/B9k2IMAEiWg3ReM3K7sXcD9v6TrlBDlKR1eOqPkgHStVtbVqVmQt0CmGM2legRwSS6e+4mDDhWKVq3WGnYPxMBp/7E6ztWFmcV3tQL5NumRbam8dlAH+1UTh1IW0edko7+yUA3FUg4zxxtKJ28V5dxNNP3BbEOI4UTRozS9aoj0i66HIfTEx8ZNx1C35PnRevK1RIUTY5Ev9j+YLXJaX889+WXV2DmNWfaSUsM8P4zWGLBplAjHic+VwpIM1iStzOlXvr1sHz2h82uw027reSaNU/fb+ilwXabKo6RCpp2tVqg18VOOsGlAPs/ov1jmT7lX9G5NCKP43AwAA) 2 | 3 | ```kql 4 | // There is a lot common between my role and my passion. Challenge accepted. 5 | let myRole = "I am just a data engineer"; 6 | let myPassion = "Just another Kusto hacker"; 7 | let challengeAccepted = "ohk-c"; // ohk, lets see 8 | print myRole 9 | | mv-expand role=extract_all("(.)",myRole) 10 | | project role=tostring(tolower(role)) 11 | | join kind=fullouter ( 12 | print myPassion 13 | | mv-expand passion=extract_all("(.)",myPassion) 14 | | project passion=tostring(tolower(passion)) 15 | ) on $left.role==$right.passion 16 | | serialize roleMatchPassionFirstTime=(role!=next(role) or passion!=next(passion)) 17 | | where roleMatchPassionFirstTime 18 | | summarize Message = tostring(strcat_array(make_list(iff(challengeAccepted contains passion,passion,role)),"")) 19 | | project Message=replace_regex(Message, @"ku", "Ku") 20 | | project Message=replace_regex(Message, @"j", "J") 21 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-39.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAH2S3U7DMAyF7/cUVq7aEaT+DMGExosgVHlttlm0TZWkEiAeHifZ1k5T2UWS2t85sTO3ygH1w+hgBwJRIxCR1rxqpLByRFNcQiAgmvQ1iSEbpbxFHDEQd1ZRGQ1xsmWdDyPeWInXVcv1eXoHRg0t1qqyzlB/TP7/DC1JoYUUmUilID7k/oB8KEQajfdoVVm1ZH33dmjJJXyXBAGeMNgfFRAcjO4gA6cBjcHvqlX90Z2SSZw+5mCdGiBf/YL6cqpvojW7TtQ7fUzpJuOc09S7xI77c9GBlZBJyNNUruDya/JlOL+Di2W4uIN9iUSHhDluK3IpvAHDCx5l9IDsxmez4LNZ9NlcfaZXYan/I+YesydT9fmSgO28Q5Oti2d44Bdab/1WrEu/lSDn4BME8iWPZFQUUVFGxSYi20iEUJHOLq9PaLB2ynAJY0+1blTll8E3ZyunL4PHVXqZHbsODf0oHls7ti62VaOrwgwlHX6qMBXJ1ZnfQoj0D5VZEIyQAwAA) 2 | 3 | ```kql 4 | let input = "aaoa iiioo iioai iioaa ioia ioiai iiooa iioio iioaa ioaia ioaoa iioao ioia aaio iiioo iioai iioaa iioio ioia ioaia ioiai ioaoo ioaaa ioaoa iioao"; 5 | let oia = replace_string(replace_string(replace_string(input,"o","0"),"i","1"),"a","2"); 6 | let base3_list = split(oia, " "); 7 | range i from 0 to array_length(base3_list)-1 step 1 8 | | extend base3 = base3_list[i] 9 | | extend d0 = toint(substring(base3, 0, 1)), 10 | d1 = toint(substring(base3, 1, 1)), 11 | d2 = toint(substring(base3, 2, 1)), 12 | d3 = iif(strlen(base3) > 3, toint(substring(base3, 3, 1)), 0), 13 | d4 = iif(strlen(base3) > 4, toint(substring(base3, 4, 1)), 0) 14 | | extend len = strlen(base3) 15 | | extend dec = iif(len == 4, d0*27 + d1*9 + d2*3 + d3 , iif(len == 5 , d0*81 + d1*27 + d2*9 + d3*3 + d4 , d0*9 + d1*3 + d2)) 16 | | extend character = unicode_codepoints_to_string(dec) 17 | | summarize result = strcat_array(make_list(character), "") 18 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-10.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA33STWrDQAyG4X1PMTvJ0IUl%2Fzf0Agk5hDGuWxqSYk9WoXePkkWiMeTzyuBnBqxXhzGGr1zCZ%2BDhY4nzz3HKwsVehj7y8B5uD82U%2FW%2FeDneqL6ldwzRS9rQFsMr0620JbME0eFsBWzL13tbAVkzf3jbA1kzB2xbYhunkbQdsyxSdlRzYjmnx9nU2u4fp7C3oJtZt5y3oJprOQUA3sW6zt6CblOnuCOgmq24Cukm9mi%2FoJqtuArqJdTs6q6CbdOlOKuimeTpfBd1U0n9T0E013R0F3bR47M6ffY1hPy5LP412ws4xbSnbXAEAQRioOAQAAA%3D%3D) 2 | 3 | ```kql 4 | let f01 = (c:string) {strcat(c, 'r')}; 5 | let f02 = (c:string) {strcat(c, f01('e'))}; 6 | let f03 = (c:string) {strcat(c, f02('k'))}; 7 | let f04 = (c:string) {strcat(c, f03('c'))}; 8 | let f05 = (c:string) {strcat(c, f04('a'))}; 9 | let f06 = (c:string) {strcat(c, f05('h'))}; 10 | let f07 = (c:string) {strcat(c, f06(' '))}; 11 | let f08 = (c:string) {strcat(c, f07('o'))}; 12 | let f09 = (c:string) {strcat(c, f08('t'))}; 13 | let f10 = (c:string) {strcat(c, f09('s'))}; 14 | let f11 = (c:string) {strcat(c, f10('u'))}; 15 | let f12 = (c:string) {strcat(c, f11('K'))}; 16 | let f13 = (c:string) {strcat(c, f12(' '))}; 17 | let f14 = (c:string) {strcat(c, f13('r'))}; 18 | let f15 = (c:string) {strcat(c, f14('e'))}; 19 | let f16 = (c:string) {strcat(c, f15('h'))}; 20 | let f17 = (c:string) {strcat(c, f16('t'))}; 21 | let f18 = (c:string) {strcat(c, f17('o'))}; 22 | let f19 = (c:string) {strcat(c, f18('n'))}; 23 | let f20 = (c:string) {strcat(c, f19('a'))}; 24 | let f21 = (c:string) {strcat(c, f20(' '))}; 25 | let f22 = (c:string) {strcat(c, f21('t'))}; 26 | let f23 = (c:string) {strcat(c, f22('s'))}; 27 | let f24 = (c:string) {strcat(c, f23('u'))}; 28 | print Message = f24('J'); 29 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-15.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA3WRUW%2FTMBDH3%2FMpLCERe8qcON26dpMZPAIve%2BCtlMhNrompk1i2u7YTH55rl7UBgfzku9%2Bd%2F%2FrZQCCfqsqB9%2BBlpQKelQE61O59cLqrGYkWcT7nYjbjEy4md3FCorgJwfr7NFUbxVuffvmq4iSKxXzG5xnPeS7mx%2FsbtdKBm0NaQvOIT3ndd7qSIp9M78Q%2FsE3Xv%2Fumg4E%2Fe13Ny75Nx8WwbVfGncrOh%2B3jTlehkSLL3jeg6ybgG9mRzzPBp%2Fw250K8xhfTjJ9OvHyIDHqwKjReht6XyihHz1rIL2Jd%2FxNKRKRVzkOxdeatz7Dtt22rnH4BYmSrNlAY7QO1%2FAk3stG4l%2BizVIHGBCM4sEaVUDioYU%2Fx3ZNraljyMV78%2BL4jS4TimI03wD44VYZCGUNjyhkSnrGH6Bw2urCm7%2BrPT0NibZ9vzpER2jXgYEDIB5JhCXdDV5F%2BvfYQvHSqq4FmST5Lbo4T7fM17K06EnJgSOhJOFjo11R3YXrChi0WRR63U9vvaJ6QfHbds1F%2FL%2FE3lTsUuJC%2BxkiIvRK3jKTEXriykad%2FWeyX0Vg01i%2Bmy4ZFY8sosi1wGj1f%2FV80TiXkL9W%2FAa9QQasQAwAA) 2 | 3 | ```kql 4 | let Addresses=datatable(Address:string) 5 | ['29.188.3.137', 6 | 'https://aka.ms/JKa', 7 | '198.90.2.219', 8 | 'https://bit.ly/ceh?sessionid=123671', 9 | 'https://bit.ly/kno#Title', 10 | 'https://bing.com/', 11 | 'https://tumblr.com/rstu?width=100&height=120', 12 | '201.6.52.117', 13 | '160.0.0.0']; 14 | let paths=toscalar(Addresses | project p=parse_url(Address) | summarize l=make_list(p.Path) | project s=strcat(' ', replace_regex(tostring(l),@'[^\w ]', '')) | project extract_all('(.)', s)); 15 | Addresses 16 | | project longIP=parse_ipv4(Address) 17 | | where longIP > 0 18 | | extend offsets=range(0,28,4) 19 | | mv-expand o=offsets to typeof(int64) 20 | | extend p=tolong(pow(2, 28-o)) 21 | | extend x=binary_and(longIP, p*15) / p 22 | | extend ch=paths[x] 23 | | summarize ch=make_list(ch) 24 | | project s=trim_end(' *', replace_regex(tostring(ch), @'[^\w ]', '')) 25 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-40.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAFVSwY7aMBC98xVTtBJBMhEJLNsWcdr20BakSru3VYVMMiFeHDuyDTRVP77P6e7CHhzFM2/eezNjzYEKa/VDOFYVrQatUybQhr2Xe6YVjYYPrSz4M4WaqVJGaqqcNUGxS+mxZs8kHffZk+1Q48lW/dUH6XytWvpqAjvwek7pW/BgOfGkY+moUd4ra0BuiX+32rpY5qSBtOEzna3TpV/GtGc+kD2GPq5VBVlT9pdCnZRWf2QA03/szupSd7S3dK4ZlMZSIw3V0iNmmHZcQenDkHYd3cs2SGXou2xg/TGlH8odRoO/8BMYChvMAL9OFmErtU5GSToeidcBjS/ANYC982QqMBInu61msw91shlPMkFZxDanCfqMzjcCFfAaupZtlaBrZfYR0jr7zEXo+YLFMpL1GHrLgcamDtwhXHZGNqpInvJZJrI5zuxW5PkCJxczREQ+xb/4JLKpyPC9E/l82iNzILNFDKHq7lYscvERtwUy8xmyc+DzX+PlyzuA3jvXUf9iGohrx/dWHxuTIeLZKYmd8GU8P61XcUNxSva8Ncdmxy6J5c9okg7KlCtlDLur1wj0jeYqpC/MtFrRjVP7OqTrK91XakwpalsX4mLfBKUvYvjYNNLBEn3hwpZcXp44Zl9IbDfuLGnkgbda+YC1CRoOrxt8X/kPdfdxFzoDAAA=) 2 | 3 | ```kql 4 | let coolStuff = 5 | print Message = '"Space: the final frontier. These are the voyages of the starship Enterprise. Its five-year mission: to explore strange new worlds; to seek out new life and new civilizations; to boldly go where no man has gone before!" by Captain James T. Kirk' 6 | | extend M = extract_all('(.)', Message) 7 | | extend L = range(0, array_length(M)-1, 1) 8 | | mv-expand M, L to typeof(string) 9 | | project L = toint(L), M; 10 | let key = dynamic([231,141,135,226,222,3,14,20,22,9,10,19,17,240,141,235,169,171,175,62,89,161,243,234,192]); 11 | print key 12 | | mv-expand key to typeof(int) 13 | | project Column1 14 | | serialize 15 | | extend Position = row_number() 16 | | join kind=inner coolStuff on $left.Column1 == $right.L 17 | | project Position, M 18 | | sort by Position asc 19 | | summarize DecodedMessage = strcat_array(make_list(M), "") 20 | | project DecodedMessage 21 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-42.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAI1S3WqDMBS+9ymCMFCo0Vh1duB7bIwhUWObtTElxk3HHn4n0Yoru5i5kJzv75wkYYhOWl/7pzA8cn0aKlxLEQpeK9nLVofvQ68D2kl9Yio4w0YGJ1qfmQq1YiwUlHdOQzWs6sK8Wjbs+anXinfHHTK7l2XnvzouwREmGY7cHbKfmxCcPuKDLTluikmeYxIlC8PAWQwai8Y4zUAd3eRzIY7yGSaYPOY4Wc0BjpObluB9hqNNcGq0WbJx3qJQOKxd2abjfGMcxThJMCHxTDBdbvUu5JJ0NrX2e2zGOsTrWJCOs1trQIaZ78ZaOiMQtc9hkCX+rmAIewwOyylYwrbgvDnfSHwEbLzSrkFn3jUFVYpOaCyOTJa8a2XZKilKfi1p0yjW914rlaAaKh/JfJ++v0PT//kvvg+p/SAEVfyLQZSW8xvwBD2z8sJ77Y3+K3mzvn+AkwVRNdkX9Lw8JGPKFKcXY8qbQvCulK2n5GfZDaJiygM/EvkPJEIBQUBno2Yw9lj0Q7WErGkjkHkDAtvEH4RpJdxNsx3CaLd9A/Wq5DurNYKzGS66ALeaam/+lfbwvXHnuiB1EVzZL2AygP8DYBEOnJMDAAA=) 2 | 3 | ```kql 4 | // https://github.com/microsoft/just-another-kusto-hacker/tree/main 5 | datatable(codeX:string, codeY:string)[ 6 | "1.0.16.0", "41.57.96.0", 7 | "5.188.104.0", "41.62.0.0", 8 | "2.56.160.0", "2.56.208.0", 9 | "1.178.4.0", "2.24.0.0", 10 | "1.36.0.0", "5.56.64.0", 11 | "2.56.0.0", "2.59.96.0", 12 | "1.0.128.0", "202.44.112.0", 13 | "41.66.0.0", "24.152.56.0", 14 | "23.88.192.0", "45.5.60.0", 15 | "14.1.100.0", "2.56.4.0", 16 | "102.38.248.0", "102.38.248.0", 17 | "103.14.208.0", "103.14.208.0", 18 | ] 19 | | mv-expand kind=array x=geo_info_from_ip_address(format_ipv4(codeX)), y=geo_info_from_ip_address(format_ipv4(codeY)) 20 | | summarize x=tostring(make_list(x)[1]), y=tostring(make_list(y)[1]) by codeX, codeY 21 | | serialize id=min_of(row_number(), 10)%10 -1 22 | | extend x=substring(tostring(x), id, 1), y=substring(tostring(y), id, 1) 23 | | summarize x=make_list(x), y=make_list(y) 24 | | project result=strcat(strcat_array(x,""), " ", strcat_array(y,"")) 25 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-41.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAI1T226jMBB95ytGPIFEtviCgVaR9rnNH6xWkUPc4AbsyHbapurH7zjJJkGrlWIkYGbO3M6BQQXoeuk8PuegPoOTXVjKYch+ptmPPC0ghecX2al+a6zzYZ/mT8kQk+y40kYGbY2HeQJ4nDQbBRpenR2BQLB480HtgBzD37G8MmtYEGx1blrAgk4sNrH4xKqu1rni+D5Tnzt5KooNw2Gn7Gvmg9Nmk/8LoveA2D0gfg+o+i9o5+yb6gJ8WLfGrTDYyZAtSOQjshB3jxvnU+p66fvluxwwJb5mMf0syDE0ytD1ZznWMuC1GhRkf9MeYbBmU8DOeh2VewRtQg6/jvh4ZlyUtGG1qEjd0KalosRRygLg4QHS570PkF7ADWlZy6tStIJyWtdlXUQ37hDB0tjQX8EzQWvBOBEtoYwRQSkVBdBzZeXgZX8DbsqK1mXbUlZywbFRHIGdCnvkdFKYVDUVNScNKxnjNW9wDg6nwrLbKncC/35Kbj/a5BverDaw1WY918bgCDcUWnPhOpmqdWUPA2hj3upw8YH0Hfr9fhyl018KvDKoXKcuIi+lc/KQjXKrloP24aQh/mdpnvwB9Vfc2o4DAAA=) 2 | 3 | ```kql 4 | let charset = extract_all(@"(.)", " JKacehknorstu"); 5 | let combinations = 6 | range i from 1 to 1 step 1 7 | | extend L1 = charset, L2 = charset, L3 = charset, L4 = charset, L5 = charset 8 | | mv-expand L1 to typeof(string) 9 | | mv-expand L2 to typeof(string) 10 | | mv-expand L3 to typeof(string) 11 | | mv-expand L4 to typeof(string) 12 | | mv-expand L5 to typeof(string) 13 | | project word = strcat(L1, L2, L3, L4, L5) 14 | | extend hash_val = hash(word); 15 | let hash_match = 16 | datatable (hash_val: long, position: int) [ 17 | -4602837651782892603, 0, // "Just " 18 | 819394506962427707, 1, // "anoth" 19 | -6276341691233162226, 2, // "er Ku" 20 | -805270992304648190, 3, // "sto h" 21 | -6157267418303347487, 4 // "acker" 22 | ]; 23 | combinations 24 | | join kind=inner hash_match on hash_val 25 | | project word, position 26 | | order by position asc 27 | | summarize sentence = strcat_array(make_list(word), "") 28 | 29 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-44.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAE1S2U7DMBB8z1dYeUkq1SVAuMVDuQvhDDdCkWlNFUibKNkARXw8a++a0qpxxzM7s3a20CCG5UiLbfGiGr0aZyNtcAZlA3U+HYd+kkeQpP0W13GSx+1gF9cZ4rQPSY6/FLHlDRejJsJ1HfdiQNwyN7b6lGtJi3yEfOy0ttbvbHkFtkWNYGMjBfh9KXSI26DrTUGtia5t3cGO9+QJ/AT9oCv8nvS7Fu0YJHu9nsHBLiFJaI85Kw32bR3+J5sDC5300EolS4+IY9MBIQ48pngp/5xOOJRqE+K59pR8ufaMlIzOiZsbXbA1lV5yS7Y4uGJbCkm5QUtdW+Gfyw0fjJS3rCSXO04g7p7vh7gHPsbc6ZE7oJhFd3AjCJY4hdCyS7Eodtc3t1pxW8YrWHUvzaI1F2PROt8KoQ1Gcv7iIrdl3P3MPBZ873nLq3BMaNy9H6G/QE9HbvibqsghNADVwu+goKrLNz0EqT7VTNjSLMLtyYfUX5VypVAKmFW6fA3dFP6Ioizf28oNcDl1kU07mag6/9Ziot51VuQN8Ej/yxO1btoCTE9QDxVkqq7VLDTijMTU4S+k+eRuugMAAA==) 2 | 3 | ```kql 4 | let code = base64_decode_tostring("Li0tLSAuLi0gLi4uIC0gLyAuLSAtLiAtLS0gLSAuLi4uIC4gLi0uIC8gLS4tIC4uLSAuLi4gLSAtLS0gLyAuLi4uIC4tIC0uLS4gLS4tIC4gLi0u"); 5 | let decode = datatable(letter: string , code: string) 6 | [ 7 | 'A', ".-", 'B', "-...", 'C', "-.-.", 'D', "-..", 'E', ".", 8 | 'F', "..-.", 'G', "--.", 'H', "....", 'I', "..", 'J', ".---", 9 | 'K', "-.-", 'L', ".-..", 'M', "--", 'N', "-.", 'O', "---", 10 | 'P', ".--.", 'Q', "--.-", 'R', ".-.", 'S', "...", 'T', "-", 11 | 'U', "..-", 'V', "...-", 'W', ".--", 'X', "-..-", 'Y', "-.--", 12 | 'Z', "--..", '1', ".----", '2', "..---", '3', "...--", '4', "....-", 13 | '5', ".....", '6', "-....", '7', "--...", '8', "---..", '9', "----.", 14 | '0', "-----", "_", "/" 15 | ]; 16 | print code 17 | | extend code = split(code, " ") 18 | | project-away print_0 19 | | mv-expand code to typeof(string) 20 | | lookup decode on code 21 | | summarize make_list(letter) 22 | | project result = strcat_array(list_letter, " ") 23 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-43.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAG2TUW/aMBSF3/kVR32pI7E1aUszNO2hRWzTVqpJRVslhJBJDLkisTPbEaXqj6+DA1VCn8+55577OenlwmJLMlVbM6FcGKukMPiGdCd5QQmb9YD4ug/g4gL/vBHDAdivwClRFPfbyhewyiuDtvIwBTNeuWkrT3/AbK1cXTZ7HkueCLCD4TIMw1ofxp0ekzEY95mhz/z8MJ7iu+aF2Cq9AZNejbz6tFTPyHklkwxMfVjmLxnLmz5ReN0WY7DMC03gKKey3EELS9phY8JndsYcE316Xw120DkoCsF+fwg2ipCRtF26ty+VFl2wE0q0MmplMRW8MMeLbQvGY6VXNeaf1bKBcdLvCOAH2drGk/8VGbKkZEPi+CTjdC0wyrQqqCqaVxkOG3GkSsqVRSqWlTsh8Qzjbtt7pUqwTYvw4f6rm8E7Xp96R3LtVnK7xzsPvvY0l64FYeVqIIRV4Frz3SIXcm0zdvKdB58iGCtKRL1XiGcrZApuEqKRSoX7CU4GZjR/d87Ok4zr87kzFnwjFsZq14g5dpvFfi87ZgWBGzNVUXBNLwITYQxf1xvcTMJtY9+n5O4DZIfooI+zs+ANunb356UDAAA=) 2 | 3 | ```kql 4 | 5 | let windowsMilestones = dynamic([ 6 | 74, // Windows 95 (J) 7 | 117, // Windows 98 (u) 8 | 115, // Windows NT (s) 9 | 116, // Windows XP (t) 10 | 32, // Space (Windows 2000) 11 | 97, // Windows ME (a) 12 | 110, // .NET Framework (n) 13 | 111, // Xbox launch (o) 14 | 116, // Windows Vista (t) 15 | 104, // Windows 7 (h) 16 | 101, // Clippy retires (e) 17 | 114, // Windows 8 (r) 18 | 32, // Space 19 | 75, // Windows 10 (K) 20 | 117, // Windows 11 hint (u) 21 | 115, // Azure (s) 22 | 116, // Microsoft Teams launch (t) 23 | 111, // Surface Hub (o) 24 | 32, // Space 25 | 104, // GitHub acquisition (h) 26 | 97, // Edge Chromium (a) 27 | 99, // Copilot debut (c) 28 | 107, // Microsoft Loop (k) 29 | 101, // Windows 365 (e) 30 | 114 // Bing Chat (r) 31 | ]); 32 | range i from 0 to array_length(windowsMilestones)-1 step 1 33 | | extend asciiCode = windowsMilestones[i] 34 | | extend ['char'] = make_string(pack_array(asciiCode)) 35 | | summarize Message = strcat_array(make_list(['char']), "") 36 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-45.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAG2TWU/jMBDH3/sp/NZW6sOm3KA+AMu5HC03i1aVmwzFJUexXWgQ73wM3rjFtUIc0mq/Eh+BmYbUiaijGSX+zd+eGTsuaFYWYINiJeZwjU/NhdyUFzTEqNJS+PUCK3Opux/L0gE5Knyd38kwHNmPs9NztPdsgWVLJfRWoQsu0G4JVH6jLxpwSSoC4R76PgOu0K4JzNro+w24Rnsl0NpAP2DADdpLRzGHftCAW0qAgHDQDxlwh/ZGwKOshg24R3smEFBWIwY8xHtM0x7WD0Oe0P4RceeJJGr/i/ZIZIu2t4pp8p+I39Ekqn+ONZvbRBLlv8Qtbk0QSdT/GncspGqsRAPe4qw9KsdKdOA9bmaRmmkNZ/6MZZp4vhqPV9SFz901aGu8ElpyX7lcQy7S8prtwG59TzT2Xc8PmgdS6dbhUTs8Hp+Y/Dk1PTM7N/9rYXFpuVxZWV1b39jc2sasIm0qPLVQKjy10Je2xhUM9lcdsAMHqjqILmOUEw0JhyAVmAkaGGZzl8v0LI3oxn+bPmEBXW5WC6NbzriyewSpludxKY6h82OoBaGoUx7fh6qL7zmazffQYUfBdxj4VISDEqzC5rrKpeRhrrsWnkq2l7wpgwbYOtanIkx89JbP5D8B+0s87toDAAA=) 2 | 3 | ```kql 4 | let Pieces = datatable(Emoji:string, Part:string, Order:int)[ 5 | '🇦🇺', '==', 1, 6 | '🇧🇬', 'QZ', 2, 7 | '🇨🇦', 'yh', 3, 8 | '🇩🇪', 'Hc', 4, 9 | '🇪🇸', 'uV', 5, 10 | '🇫🇷', 'HI', 6, 11 | '🇬🇧', 'id', 7, 12 | '🇮🇹', 'mZ', 8, 13 | '🇯🇵', 'oh', 9, 14 | '🇰🇷', 'FI', 10, 15 | '🇲🇽', 'lJ', 11, 16 | '🇳🇱', 'Xd', 12, 17 | '🇳🇿', 'nJ', 13, 18 | '🇵🇱', 'WY', 14, 19 | '🇷🇺', 'uB', 15, 20 | '🇸🇪', 'yZ', 16, 21 | '🇹🇷', 'mh', 17, 22 | '🇺🇸', '2V', 18 23 | ]; 24 | print OriginalText = translate( 25 | 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ', 26 | 'nopqrstuvwxyzabcdefghijklmNOPQRSTUVWXYZABCDEFGHIJKLM', 27 | base64_decode_tostring( 28 | reverse( 29 | toscalar( 30 | Pieces 31 | | order by Order asc 32 | | summarize PartsList = make_list(Part) 33 | | extend encoded = strcat_array(PartsList, '') 34 | | project encoded 35 | ) 36 | ) 37 | ) 38 | ) 39 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-47.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAE2TwW7TQBCG736KUcQhQVYqzlUFSIBoRS9IiEsFHa8n9pL1rNlZx3VPvAKvyJPwr9MKLpGznv3n/78ZB8k0Rhnoiu7v76+Vci+UhMNA8UC33qVo8ZDpAzfJu5rmXpKQnEQz9XEyMbLeqxBed32uq3ecmSxDYjBybI5boeCPgkNOYS2inFjtENPgtSPXczTymiN+rBTsq89w8OfX7+wHwWEnln1UOkwSjFpvLp4kLXXxkRZqliyEpiOnI1mE+iR19ZZsGcY+6lKShNgZsbY0SEYQQ07O1E0e7uKUaOTc473M++pmanxg5JsUTZFvUUAx/yj/fHPxY5fEhY+RSp5jOlrpVDzXYJP8Y7ktalMqMZMEz1D2ebmkIwfxbUSQ0Ts0aiUBj7alcM0Bg+J69T8nEI4jRDkEXOw5qZiVOm5PrE5aUB7Pwh61R41zkLYTbsJy7o7TFJvJcrm5r776jIkBgC/uQF8zRNo4sFcgZdc/zbcRFwdcZtKYyxzw5KINcGxRu7q6DmHCCAEDdnrftqIFZJak9rwqXjWeVlwr/jmWrJAOUNhj5S6riwt6/wCyLq/LtyLN6BHKWm3L0fq0DqyRDjtCMyLQ5mazqwL29/nGp1J2RXIW277ZbF8Pu2/bm/3L3YtNTa/qddN3a8cvZ4SYSicPhNUDxAxUq4WDxzQI0khSRroywYBbWrnBR3FUl1qlH9Fr0cKfAUKd4CHtqxFDz/RxhXIL7twVb/gwHOfvnBIv2yej3zFZmL1rtnfzDj7/j7OraUOb3V/2AqPGpgMAAA==) 2 | 3 | ```kql 4 | let poem = ```In the realm of Microsoft Fabric, where event houses shine bright, 5 | Data streams cascade like starlight, transforming chaos into insight. 6 | Real‑time ingestion fuels discovery, every byte a spark so true, 7 | A symphony of logs and metrics that guide our path anew. 8 | Jubilant unions synthesize transformations; across networks of time, horizons ensuring reliability; kaleidoscopic understanding sparks techniques optimally; harnessing advanced capabilities knowledgeably ensures robustness. 9 | Within this enchanted domain, each event becomes a note in a cosmic song, 10 | Illuminating hidden patterns, where innovation and wonder belong.```; 11 | // Extract the acrostic line (the line that begins with "J") 12 | let acrosticLine = extract(@"(?m)^(J.*)$", 1, poem); 13 | // Using a regex to capture the first letter of each word in that line, then joining them together. 14 | print HiddenMessage = strcat_array(extract_all(@"\b(\w)", acrosticLine), " ") 15 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-46.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAHWTb2/TMBDG3+dTnPKmjpQxsQ00DVUaElAJxBuKhtA0omtybb05cWRf/018eM5OmtIVkle2n/vd+bmzIYYplY74K3mPC4IxVMjyzwwpakpbUXXj2elmkUNrvWZtmxvdcJbcJyBfOm3unqv343Gaw+schu/8HNLPK89pp/r54826mixNuYjKi/ygwsbyklwvnF4KbnIdRJcvcF8EZ3sZTj494sXdTmRXcCxbYvkUcA/vkkTWH+R6u5YBmwrYYePn1tUgGaHurpwcGZD8BtoyiTjpgQIQF2LEDD29vYIWHft4XMWzSlzrjopuo2Dbeba3MDvFftxKNSXDXDvPUC4xrMiBqqi2jYRjsDqL8qgpgkYyUReo0l/qVda53peR5S/haAys7YaM/ye3PxqYhehVqu6RtF09BPgJ+Ru1BkuCEY5go3kJo9sRMNWtdei02UVdbSs919EX1+kLRwvaqh6XSwMFnt6mB2P2Caat0QwyYfZgSmd2WIZifVCofQ7BREq9PqNtG7ocdaeGfw/NN8gUS57JlIDkkHtEgSMZLhdL5r1QSYF9qUNDIzwLCf2qruXKzwQb60KcKEoUD53DnarxiQqjPas9OYuVwmw3vCOBSKT0/K89QF8ewevhYf6HH7IHNkQbZDb9ISh2SApYGe5fcZA4+0gyHN3+H8SGzT8DBAAA) 2 | 3 | ```kql 4 | let SecretMessage = datatable(encoded:string, position:int) 5 | [ 6 | "SnVzdA==", 1, // "Just" 7 | "YW5vdGhlcg==", 2, // "another" 8 | "S3VzdG8=", 3, // "Kusto" 9 | "aGFja2Vy", 4 // "hacker" 10 | ]; 11 | 12 | // Decrypt and transform the message 13 | SecretMessage 14 | | extend 15 | // Decode the base64 parts 16 | decoded = base64_decode_tostring(encoded) 17 | | extend 18 | // Extract first character (demonstration) 19 | first_char = extract("^(.)", 1, decoded), 20 | // Extract all vowels (demonstration) 21 | vowels = extract_all("([aeiou])", decoded), 22 | // Replace 'a' with '@' temporarily 23 | modified = replace_regex(decoded, "a", "@") 24 | | extend 25 | // Split into characters 26 | chars = split(modified, "") 27 | | mv-expand chars 28 | | extend 29 | // Translate '@' back to 'a' 30 | restored = translate("@", "a", tostring(chars)) 31 | | summarize word = strcat_array(make_list(restored), "") by position 32 | | order by position asc 33 | | summarize message = strcat_array(make_list(word), " ") 34 | | parse message with result:string 35 | | project result 36 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-48.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAI1UzW7UMBC+71OMctmEutL+taVFK4H4kQBxQVUvq1VlkmHXXceOHC9sEQcegAqJE7e9lEvprUI9lKfhCfYRsBOX/DS7aqJo7PHM98188oSjhuexPGFvaAJDiKg27zuOfuY8SLViYkLgiPIDJnQAoxaYx1stz7+ult/+eKRD7O7sxiPdbHV+4ZFetvrx+++Xs9Xy+y+P9HPHlUcGedClR3ay1c9rj+y2xo9a3BYiQhlhlFGna6spFWFpq0yOxhVSMpcNzmpe7cyhuDYLjzU1fttEYRyAO6sSVxOaGS/qxDb6v+x3Tjc10RB9VTaN+jVKZZ31Gu4vYmPz64raLMB9JF/b/Gap7DWsXMHWZ+BSzuZJMSJS5GtzlM7jmCr2CeEZmzBtL2xMZ3jMWap9MzCBicGFRhHBSxGxEG2EomKCvhkaqhQ9PeYoJnrq5wDBthmhvk2LP2zjIqEmk4kIFybvFkFL0KcJyve+HceC4VCxxI7Q0AGn3IQ7XJKjOLOVMXycosJqEQ4igOEQ+gXykzRkzOBqaRhvg0adcfBgsA9bNXfXuPfueHvjoKLX0ylVVbkyEhuUKHmCoYa3mM65bUdhwqlp5XF7RGDcJtA2n5b5r8DPkIKSDi+YoNxWa4ROOdXo50gmr9Pt9Qc7u3sP9y3Kq3mqgQqpjRDw2mwkTGk4Q9Uul5HB/QNlQfYnJAUAAA==) 2 | 3 | ```kql 4 | let EmojiMap = datatable(Emoji:string, Val:int) [ 5 | "🤌🏼",0, "🍻",1, "🤪",2, "😵‍💫",3, "😳",4, "🤬",5, "🥷",6 6 | ]; 7 | let EncodedEmojis = datatable(Emoji:string) [ 8 | "🍻","😵‍💫","😳","🤪","🤪","🤬","🤪","🤪","😵‍💫","🤪","🤪","😳","🤌🏼","😳","😳", 9 | "🍻","🥷","🥷","🤪","🍻","🤬","🤪","🍻","🥷","🤪","🤪","😳","🤪","🤌🏼","🥷", 10 | "🤪","🤌🏼","😵‍💫","🤪","🤪","🤪","🤌🏼","😳","😳","🍻","😵‍💫","🤬","🤪","🤪","🤬", 11 | "🤪","🤪","😵‍💫","🤪","🤪","😳","🤪","🍻","🥷","🤌🏼","😳","😳","🤪","🤌🏼","🥷", 12 | "🍻","🥷","🥷","🤪","🍻","🤪","🤪","🤌🏼","😵‍💫","🤪","🤪","🤪" 13 | ]; 14 | EncodedEmojis 15 | | lookup EmojiMap on Emoji 16 | | summarize Digits = make_list(Val) 17 | | extend Indices = range(0, array_length(Digits)-1, 3) 18 | | mv-expand index = Indices to typeof(int) 19 | | extend Triplet = array_slice(Digits, index, index+3) 20 | | where array_length(Triplet) == 3 21 | | extend Ascii = toint(Triplet[0])*49 + toint(Triplet[1])*7 + toint(Triplet[2]) 22 | | summarize Chars = make_list(Ascii) 23 | | project Result = replace(@'[, ]', '', tostring(Chars)) 24 | | extend Final = translate(Result, '0123456789', 'Just another Kusto hacker') 25 | | project Final 26 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-50.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAJVT3W6CMBS+5ylOdiNNuoQq/i1hLzIX7LCbTAQCddPFB9ilJnMmS3w5n2RtqQgImSuN9Dvf+flOOU4oF89TwEx6BylP/PAFPRgg1ng8Vm84fn/KvdsXUb7LZolKRJ29nHZbBF/H3UbuuhTbotehkiI/NievCq/l8tyNUUZ2urKDS6722qpRxnH30yitru0G+775mmSFrKjeum1tPpSO/7MbcnYejTXM325pHAcrCJw0DnxuUgytUTIKWwh4BHwVs+jZ1GMHUQim+nxxEr0yj2efUqyp40WLkAvXQMRDC+GcoiVK9FYkvTK52xfJWYXcFsm0Qm5aSHFreJ+yhMEU7sHSFq0Wlk5MvZlLk4SuzDzTaS1C34smzJU/ceSHPHV55GatX3or9TRl5hQcB9odDH0bgwJkgIGQnkZtC2g4AU+eLQzDPoZOu9DIRUKqcnRlDuGbITsLVKBNBGXZJ0rU6XdPoC+jiEay2vCvakpXT4aJJAoQpXcmjx0tomq3pd3Sdutst6Syk78C5Kr61RSkQYqQmDvJxs9iCC642Rp09UU1KvB9MdtiUAY6ykIXbmULQuI/ky7mc5r4HwwSR4yHR7keqTmdMTfwU24uEYabG2T8AvAKJxy9BQAA) 2 | 3 | ```kql 4 | datatable(a: string)[ 5 | ' ██╗ █████╗ ██╗ ██╗ ██╗ ██╗\r\n' 6 | ' ██║ ██╔══██╗ ██║ ██╔╝ ██║ ██║\r\n' 7 | ' ██║ ███████║ █████╔╝ ███████║\r\n' 8 | '██ ██║ ██╔══██║ ██╔═██╗ ██╔══██║\r\n' 9 | '╚█████╔╝ ██║ ██║ ██║ ██╗ ██║ ██║\r\n' 10 | ' ╚════╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝\r\n' 11 | ] 12 | | mv-apply l=split(a, '\r\n') to typeof(string) on ( 13 | project 14 | h=countof(l, ' '), 15 | a=countof(l, '█'), 16 | c=countof(l, '╗'), 17 | k=countof(l, '║'), 18 | s=countof(l, '═') 19 | | where h > 0 20 | | project x=pack_array( 21 | unicode_codepoints_to_string( 22 | case(h == 23, 74, h == 18, 116, h == 20 and c == 0, 97, 32), 23 | case(a == 15, 117, a == 14, 97, a == 21, 104, a == 16, 75, a == 17, 111, a == 0, 99, 32), 24 | case(c == 6, 115, c == 1 and k == 3, 117, c == 1 and k == 4, 110, c == 0 and k == 0, 107, c == 0, 101, 32), 25 | case(c == 0 and k == 0, 101, c == 1 and k == 3, 115, k == 0, 116, k == 4, 111, k == 3, 114, k == 5, 104, 32), 26 | iif(s > 8, 114, 0) 27 | ) 28 | )) 29 | | summarize r=strcat_array(make_list(x), "") 30 | 31 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-52.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAIVTW2+CMBR+91c0zR7ahCWbuzxs8YG32fbF+OQ2Qyo0hAzUIBs69b/vlGsL6BCwnHO+y+klVhliXDDOppwxITiaIFJ8C/6yy9JoHTrlJ1TVAaQjAp66hB6zTTkiap+l0s88GcekAToNgNLz6yjuiLILoqK4GH8JDmuZRL4hY6aHKMWlPhiYgKARGwjBPAgrSI+p2sbSV16qQrUnJpXJYYP7xuAaMMYsRaPZakjYZVZxhZUX09NSOrqYtz3Bvy9hqdJUHkhbXpX1dUB9QEdoU2WsYV7JnXp+9ALlbwLlNatmlNbsFTfc8BvuQmdYVWRsuGidkU62tcysHV3P4we+wQ6eTOAF9/gJL+nraAuERZeiZNMGtRE8D4OZnwfu1F3MVuEKRtJ9n/nh1J3nZWaVTyG2mC1ymesMpqMTghOg1gGquDSVdcAILqQYBwfk8zM/js8UO7Y8RSeU/Nyq/VYCk7V9DHitoEV330ki0+hXIebyt0ZTdED9F3YS+aW8ONrBbJorPYwpnLan7CqxdcR7lYb/bqWGGgv4cbf8t+R+SSl1rM1EcD0s93MX8gCQvscKr3GwIF3MGDCjP+fISbE0BQAA) 2 | 3 | ```kql 4 | let JKLJKJIKJJLLK = (KLJKJLK:string,KLJKJLJKL:string, KLJKLLJKK:string){tostring(extract_all(KLJKJLJKL,KLJKLLJKK))}; 5 | let JKLJKJIKJJLLJ = (KLJKJLK:string,KLJKLLLLLLJK:dynamic){tostring(KLJKLLLLLLJK)}; 6 | let JKLJKJIKJJLLL = (KLJKJLK:string,KLJKJJJKKKJL:string,KLJJJJKKKJL:string,KLJLLKLJKKKJL:string){replace_regex(KLJKJJJKKKJL,KLJJJJKKKJL,KLJLLKLJKKKJL)}; 7 | let JKLJKJIKJJJJJ = (KLJKJLK:string,JLJLLKLJKKKJL:dynamic){todynamic(JLJLLKLJKKKJL)}; 8 | let JKLJKJLKJJJJJ = (KLJKJLK:string,JLKLLLJKJL:dynamic,LKJJKL:string){strcat_array(JLKLLLJKJL,LKJJKL)}; 9 | let JKLJKJLKJJKKJ = (KLJKJLK:string,LKKJLKLJKJL:string){base64_decode_tostring(LKKJLKLJKJL)}; 10 | let LJKJLKJLKJKJK = (KLJKJLK:string,JLKJKJKJJLKJLKJ:string){toint(JLKJKJKJJLKJLKJ)}; 11 | let JKJJKJIKJJLLK = dynamic(["$","==","","25"]); 12 | print JKLLJLKJKJLKLJ = ("SgdQcwdAIAYQbgbwdAaAZQcgIASwdQcwdAbwIAaAYQYwawZQcg") 13 | | extend LKJKJLKJ = JKLJKJIKJJLLK("JKLLJJK","(\\w{2})",JKLLJLKJKJLKLJ) | mv-expand JKLJKJIKJJJJJ("JKLLJJK",LKJKJLKJ) 14 | | summarize JAKH = JKLJKJLKJJJJJ("JKLLJJKLLJJKLLJJKLLJJKLLJ",make_list(JKLJKJLKJJKKJ("JKLLJJKLLJJKLLJJKLLJ",JKLJKJIKJJLLL("JKLLJJKLLJJKLLJJKLLJJKLLJ",JKLJKJIKJJLLJ("JKLLJJKLLJJKLLJ",LKJKJLKJ),JKLJKJIKJJLLJ("",JKJJKJIKJJLLK[0]),JKLJKJIKJJLLJ("",JKJJKJIKJJLLK[1]))),LJKJLKJLKJKJK("LKJLKJKJLKJJKL",JKJJKJIKJJLLK[3])),JKLJKJIKJJLLJ("JKJLKJLKJLKJKLJL",JKJJKJIKJJLLK[2])) 15 | 16 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-6.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA7VTy27bMBC85ysWvEgC6EKK5bQF6qIo4Bz6SgLbusSBQNMbSZYsCiTTSEY%2Fvks5Rp0EhttDD%2BJjObM7s6QaXdQWmNUdO%2FsF2FqsV9DCGKwWtamERZ%2BtRZlDYcAqBVKLbcc4sPloep2Un5Po5ibJf4xm31xQrWVXFsIAQK6s3rLgedKlMHgRpyuUaoWpVcZS%2BcxvD2Dd89pZTiADQiNUaAwYKXRffzzJrvIrSKYzsLMwhHCeTC%2FdgcgrKXLboRFaqixjL5If0QDdAW4bEZDWWkibiqrymf8mYNw8LPeKecjjIOCwPT%2BJjJ%2BQw5PIdw5JKtaqqKEs6tUYirpGDf4ZdRSaY3d1zBJLJnaeTPLLWZhM59l4zP6fx%2BFfenzLz3tkfBL5nkfUjQBUvXOehkDqG63WKO1APIpuH%2BfQcuj4fhvRPiLo5ucA20b0Xp0Lp4%2B%2BqN%2B4YeiG%2BE9LLG4a9%2FxUpR5R%2B6RECusT%2BSg3OGhohTWRiUQL36UK4FXq4v7ep%2BMPFxw0NpWQmGrMsO3xHLzS495XL%2BA9%2FZ%2FZa2J%2Fec3eCduTR6B0H%2FpIaWgexP3k8Eqv6LEtu%2F5YGOn0m4fNRuhii%2FCd%2Fj%2BRIaV6UXz%2F3jaixLQqjN25p1v%2B5N0ubhdscXfnkTzvQNOxZE9xR%2BWOA17wG8lgZHCjBAAA) 2 | 3 | ```kql 4 | print "try" 5 | | extend x = translate("jakh is too crazy", "U5SPVkBV1QQVhN5TL", "ojcykias hotrz") 6 | | extend x = base64_decode_tostring(x) 7 | | extend y = translate("ghosts are less scary", "=EgOhO VST tT00 0UVSF", "ahlcahtyesarcogg") 8 | | extend y = base64_decode_tostring( y) 9 | | extend z1 = extract_all("(.)",substring(x,0,4)), z2 = extract_all("(.)",substring(x,4,4)), z3 = extract_all("(.)",substring(x,8,4)) 10 | | join kind= inner ( 11 | print "try" 12 | | extend x = base64_decode_tostring( "VEtUVEhFT0VSUg==") 13 | | extend z1 = extract_all("(.)",substring(x,0,4)), z2 = extract_all("(.)",substring(x,4,3)), z3 = extract_all("(.)",substring(x,7,2)), z4 = extract_all("(.)",substring(x,9,1)) 14 | ) on print_0 15 | | project-away print_0, x, y, print_01, x1 16 | | mv-expand z1, z2, z3, z11, z21, z31, z4 17 | | extend temp = tolower(strcat(z1,z2, z3, z11, z21, z31, z4)) 18 | | extend len = strlen(temp) 19 | | extend temp = iff(len<6, replace_regex(temp, 'k','K'),temp) 20 | | extend temp = iff(len<6, replace_regex(temp, 'j','J'),temp) 21 | | extend len = iff(len<5 or len >6, len-4, len) 22 | | order by len asc 23 | | summarize Message = replace_regex(tostring(make_list(temp)), @'[\[\"\]]', '') 24 | | extend Message = replace_regex(Message, @',', ' ') 25 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-49.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAHWUW2vCQBCF3/0VIU8RLLgbtZXiQy/2IsVKBaGIhHV3UNskK5vUIvTHd2dp04d6Xj6WnJ05M5NMcqqjyUexzsmMS20NmdnWqYqiUWSOpSp2OlnGRdyJ4hEjZ6SMe8YLQzBeGQtGl2EYY4ZusGmyhHuPjDljzVAM2dwL6hNjynhgDJtTgGNMGHeMA8MyinjVvmzlvrOpLW/slhyV9bVvatDzbVW106pOTjW9FHLVaZ1Uuki4QEIKQ86RIAVMBgtLe0gR0AeGSBgyhC4prAyGDKA/rgxmkzBbCscJpynhS5PwRfehP54AHGcKswnYjcCfAG4HViBhBXDQAs5Gwknjbvq/23tL4bnf3Cul3z+VM1WzxetwyEy4ktXWb/Wu3CT/Fv4n1czZPbn8+OyMF83c61Rq+vsdODqQqyiBnm2fae89YK7WV7R39o10febtVUHRYmdz5S1CWNb9BhmyqSlrBQAA) 2 | 3 | ```kql 4 | let JumbledEncodedPhrase = dynamic(["m", "=", "l", "3", "G", "R", "1", "Y", "V", "0", "d", "E", "c", "c", "g", "=", "V", "I", "S", "b", "a", "2", "g", "I", "L", "N", "H", "9", "H", "H", "r", "J", "F", "v", "o", "m"]); 5 | let NonCoherentBase64 = strcat(JumbledEncodedPhrase[12], 6 | JumbledEncodedPhrase[0], 7 | JumbledEncodedPhrase[8], 8 | JumbledEncodedPhrase[30], 9 | JumbledEncodedPhrase[7], 10 | JumbledEncodedPhrase[21], 11 | JumbledEncodedPhrase[32], 12 | JumbledEncodedPhrase[34], 13 | JumbledEncodedPhrase[17], 14 | JumbledEncodedPhrase[4], 15 | JumbledEncodedPhrase[27], 16 | JumbledEncodedPhrase[9], 17 | JumbledEncodedPhrase[13], 18 | JumbledEncodedPhrase[3], 19 | JumbledEncodedPhrase[16], 20 | JumbledEncodedPhrase[24], 21 | JumbledEncodedPhrase[23], 22 | JumbledEncodedPhrase[26], 23 | JumbledEncodedPhrase[31], 24 | JumbledEncodedPhrase[2], 25 | JumbledEncodedPhrase[20], 26 | JumbledEncodedPhrase[28], 27 | JumbledEncodedPhrase[5], 28 | JumbledEncodedPhrase[33], 29 | JumbledEncodedPhrase[19], 30 | JumbledEncodedPhrase[35], 31 | JumbledEncodedPhrase[11], 32 | JumbledEncodedPhrase[14], 33 | JumbledEncodedPhrase[10], 34 | JumbledEncodedPhrase[29], 35 | JumbledEncodedPhrase[25], 36 | JumbledEncodedPhrase[6], 37 | JumbledEncodedPhrase[18], 38 | JumbledEncodedPhrase[22], 39 | JumbledEncodedPhrase[1], 40 | JumbledEncodedPhrase[15]); 41 | let DecodedBasAackwardsBase64 = base64_decode_tostring(NonCoherentBase64); 42 | let ProperlyOrderedSentence = strcat(reverse(DecodedBasAackwardsBase64)); 43 | print ProperlyOrderedSentence 44 | | project-rename Viola = print_0 45 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-8.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA42UwW7CMAyG73sKixOTOGCgBYR24DYx7Q24VKga06Cd2uz9579FqZs6papkpXb%2Fz6kT%2B5Y7ui%2BZ3mh2%2BqvdsSjdNa8%2BZFm%2BZ5efvDo7PETkru3SO2q%2FhNIHoClmh5dbQ16Nk8H1EcXuPgwzSFDUKsMaGZpIj9FP6d39PQzg4lbojYke%2Fk2Lsf6wgzcFKxU8mQgXEFGkgAovfgVPpxTlgTFT6sq056HoW5uuz3KMrtlNQKF3Jlpen4P1bURAUfcxKtE4Nc7kZYT5cNjEoGWQXSE5jiSykeoL%2B7B4FYWKa4g8D4jh5WK74%2FxG%2B0STF%2FQC243mhR2vnyrWuJw8m2d%2Bsy04ig2GDafTwKKsTmFhzCn5W30Xjj7zus6%2BcoHXrrpkbi4jeYHpCbOG2cAkMCnMFmYHs1%2FgLsJAwVAwFAwFQ8Hp6%2BEfxFvdTOcFAAA%3D) 2 | 3 | ```kql 4 | let m01 = "JustAnotherKustoHacker\t\t\t th\t\t\t\t\t\t st\t\t\t Just\t\t\t\t ker\n"; 5 | let m02 = "JustAnotherKustoHacker\t\t tAnotherKu\t\t\t\t erKustoHac\t\t Just\t\t\t ack\n"; 6 | let m03 = "\t\t erKu\t\t\t\t ustAnotherKust\t\t\t\t therKustoHacke\t\t Just\t\t\t oHa\n"; 7 | let m04 = "\t\t erKu\t\t\t\tJustAnotherKustoHa\t\t AnotherKustoHacker\t Just\t\t sto\n"; 8 | let m05 = "\t\t erKu\t\t\t\tJustAnotherKustoHacke ustAnotherKustoHacker\t Just\t\t Kus\n"; 9 | let m06 = "\t\t erKu\t\t\t\t ustAnotherKustoHackerJustAnotherKustoHacke\t\t Just\t erK\n"; 10 | let m07 = "\t\t erKu\t\t\t\t tAnotherKustoHackerJustAnotherKustoHac\t\t Just\tother\n"; 11 | let m08 = "\t\t erKu\t\t\t\t\t notherKustoHackerJustAnotherKustoH\t\t\t JustAnot\n"; 12 | let m09 = "\t\t erKu\t\t\t\t\t therKustoHackerJustAnotherKust\t\t\t JustAnot\n"; 13 | let m10 = "\t\t erKu\t\t\t\t\t\t erKustoHackerJustAnotherKut\t\t\t Just\t the\n"; 14 | let m11 = "\t\t erKu\t\t\t\t\t\t KustoHackerJustAnothert\t\t\t\t Just\t erK\n"; 15 | let m12 = "\t\t erKu\t\t\t\t\t\t\t stoHackerJustAnoth\t\t\t\t\t Just\t\t Kus\n"; 16 | let m13 = "\t\t erKu\t\t\t\t\t\t\t oHackerJustAno\t\t\t\t\t Just\t\t sto\n"; 17 | let m14 = "\t\t erKu\t\t\t\t\t\t\t\t ackerJustA\t\t\t\t\t\t Just\t\t\t oHa\n"; 18 | let m15 = "JustAnotherKustoHacker\t\t\t\t\t\t kerJus\t\t\t\t\t\t Just\t\t\t ack\n"; 19 | let m16 = "JustAnotherKustoHacker\t\t\t\t\t\t\t rJ\t\t\t\t\t\t\t Just\t\t\t\t ker\n"; 20 | print Message = strcat(m01, m02, m03, m04, m05, m06, m07, m08, m09, m10, m11, m12, m13, m14, m15, m16); 21 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-53.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAI2UW2/iMBCF3/kVo74kkVIVaAGhqg8seym97KXde1UhN0zBJbEjx4GyZf/7HjtsYbfsBemLsD3j8RyfJGVLJ2Vhe0rbCZtT/NXHIpmyoSMKI3qo7e1RYlhYJlEkUlIm8lyqcS1Fpp85ryaq+NpDjfBzi2Wes+mLgrEyWiiRySS8CnpBHDwDffAcvAAvwStwDAbgBJyCM3AOXoM34C14By7AJXgPPoCP4BP4DL6Ar8F1dOjPEeZGKku9y/5ggGMYocYctltxtx43IlpSNtvl+1yo0SpkSXxvGcP+RDgFrC4sdhiHj81cVYG71G5dR5EvsqRSSa3+XLDbiRvN5v9WTPWcTfiXyt0OKv8snRt9x8m6otWoH/pRFPtNN89I2w7pEvabUfx7zwEFEXT8frjpAUXCGLEgfUswzMoTCTJFYtkUZJhzwwUrK6wreKsN7TiHIdVbjLzHaOJNtuNt5NL7esTFplM6BzE1Gh33aLlHO6b9Zozm3aDuHo3VdKPuQut+eFBFdVpPkn28W/Phbptu1w0661znGrRqSgWXK5mXqe+h8E0kWs3YWOd0aSESFYlIIZgTYpEzVaLRXNqJV2Ym0pLd6r+6h1platH6r7eyFqX21DW1R9tsu3esFmykSOU33gi90HNnST0fqjK7gcdc4B3yaCrV6EgqhfNtvtJ4n3GDfk9EajPC+s3C74MwV6XMMmFcFW+KITRIhA0zMeVhKgsbOktFcRBAWNjKCxZW/UbOV1XH278/YfQDnYm0U5wEAAA=) 2 | 3 | ```kql 4 | let JustAnotherKustoHacker = () { 5 | // create ascii mapping 6 | let asciiMapping = () 7 | { 8 | let upperCase = dynamic(['A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z']); 9 | (print ASCII = range(65,90,1) | mv-expand ASCII | extend Char = tostring(upperCase[ASCII - 65])) 10 | | union 11 | (print ASCII = range(97,122,1) | mv-expand ASCII | extend Char = tolower(tostring(upperCase[ASCII - 97]))) 12 | | project ASCII = toint(ASCII), Char 13 | | union 14 | (print ASCII = int(32),Char = tostring(' ')); 15 | }; 16 | // create an array of the ascii characters reepresentation for "Just another Kusto hacker" 17 | let charCodes = dynamic([74, 117, 115, 116, 32, 97, 110, 111, 116, 104, 101, 114, 32, 75, 117, 115, 116, 111, 32, 104, 97, 99, 107, 101, 114]); 18 | // run manipulations for converting it to scalar of type string with the value of "Just another Kusto hacker" 19 | let result = print ASCII = charCodes 20 | | mv-expand ASCII 21 | | extend ASCII = toint(ASCII) 22 | | serialize 23 | | extend Row = row_number() 24 | | join kind=inner asciiMapping() on ASCII 25 | | order by Row asc 26 | | summarize array_strcat(make_list(Char),''); 27 | toscalar(result) 28 | }; 29 | print JustAnotherKustoHacker() 30 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-51.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEANWV0WrbMBSG7/0UQlcyqNAkENhKr7pRBoXe7C4Eo9hKqsSWPPl4Scpu9yZ7s73Ifid27abpSpJlUOwPG/k//zmShU6qialJzK5ZsrYqM7EYccUln4AYJECDKZiBB2DAHCxACjJggQM5+AY8KACBEnwHS7ACa/AIGB+HV0GKCnLlqYcaCvKxIlGUE7wZOxM8U36hYcYGkvXCjrxfyVvd0tW6fqVrZYPnskx13K6CRBGuSaqZMB/ZVhQGo4D//vnrLzeXbynevE+yODX/P6j/VdPDvA+u5JxT3/Pt+HTnXOOzZ35fu/O/L/W+rX7srzlhhwXj4AfTK9I2YbErLUU47DYvbirI1WeeCeWm2JBd9Fr9nSbSvkAATv/dYYwaMxWN5zXjHzhznnUGepdckivzXHtRe422n8eh3B1o/T+vdFySju59on00HCITuabzbMMqdVFmOPjNo2Y3zqIjaAuSrzB5ahKR8l6tRXWgR6kpSOxah5Jx3kl9q90XO3Vtl2nK3zQfqDftYvvod+L2VZCnhtoV3lWEss7Vnfgnr2bOdrPX0S/DR5dYQ3KpW6K6xqryyr2b65gu1FKtX9Qlmxn+AYcgOoPTBwAA) 2 | 3 | ```kql 4 | let abc = dynamic(["a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z"," "]); 5 | let part1 = strcat(substring("marker", 3, 1)); 6 | let part2 = substring("worker", 2, 1); 7 | let part3 = substring("maker", 3, 1); 8 | datatable (i: string) 9 | [ 10 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 11 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 12 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 13 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 14 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 15 | "ㅤ", 16 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 17 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 18 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 19 | "ㅤㅤㅤㅤㅤㅤㅤㅤ", 20 | "ㅤㅤㅤㅤㅤ", 21 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 22 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 23 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 24 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 25 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 26 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 27 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 28 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 29 | "ㅤㅤㅤㅤㅤㅤㅤㅤ", 30 | "ㅤ", 31 | "ㅤㅤㅤ", 32 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ", 33 | "ㅤㅤㅤㅤㅤ", 34 | "ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ" 35 | ] 36 | | extend count_ = countof(tostring(i),"ㅤ") -1 37 | | extend Letters = abc 38 | | extend Letter = iif(count_ == "9" or count_ == "10",toupper(Letters[count_]),Letters[count_]) 39 | | extend Execute_Order_66 = todynamic(Letter) 40 | | summarize ConcatenatedText = strcat_array(make_list(Execute_Order_66), "") 41 | | extend GeoInfo = strcat(toupper(part1), part3, part2) 42 | | extend ConcatenatedText = split(tostring(ConcatenatedText),GeoInfo) 43 | | extend EDragon = strcat(tostring((ConcatenatedText)[0]),tolower(GeoInfo)) 44 | | project-away ConcatenatedText, GeoInfo 45 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-55.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAG2SUW+bMBCA3/kVN6SpUHBKEFQpUx6mPEyVtr30sauIkzgJGtiZbbpk6o/f2ZBg2pwUybG/++7OpmYaarETT1pWfAdzWC6X3u3HiOajIB4AXCNIQXqCWMahzgoymUwKC1yYnnqvKIrCZTCiQUGsojCyMYMx9FnYU7dWtz5TjoKgMfIuhEHMb06cmEcYnuMYL3rAMBfFSAYDEUVuP2TUWTRi3hPkchturWvAgHnD/hWiozx8+y9ejV+EaOXPtsGvwb9Pcpax/CFJ8lWWZHm+zfNslqdTem/Ws+whS/Eszba4SvJZvvU7RcurPy1b7KlU6NFCrWlNZWBnlpTvGFSwlaKBBA9BaVkzHgxfYkimuMkOMLUZb8COmvENrPdoU+1KWcpJiKGKYRr29N89k8zAn+Zw84vf9NuqbRoqq38MGvqblYrpYL0PvbBrmUr5nfGdNiVwTU9lbf8GziyIfuw+zc69jvvEqbs2HcFzBZ+HSi+hm1KuxYbZvFp0WWbD7h5ExbUqTc2yl2Lnz8lLCHB3B9+w/a9Pi8dHMPDg3LNjuTppR6qNKEDFmurAT45+7Fxn9+54lXALaQxpiGH0C8FfmdRGBwdaSTM0b5sVk0Opo5DlK62x0qriVJ5K3Aj6meJLI868G2aONphwZVAtzmP2XpM4PN8PphTdmbG6SUr7XoF91bpSOujlYQy+H/4HW25CbuUEAAA=) 2 | 3 | ```kql 4 | let logoString = ``` 5 | *******************+==============- 6 | **************+=====-:-======--- 7 | *********+=======-...:==------ 8 | *****+=====-:-======-:::---- 9 | +======-...-==---:...:--- 10 | =========-:.:--------- 11 | ------ ====---:...:-----==+ 12 | ------- - =------------=++++ 13 | ------ ----- -------=+++++++ 14 | ----- ------- - --=+++++++++ 15 | ------- ------ ++++++++++ 16 | ------- ------- +++++++ 17 | ------- ------- ++++ 18 | ----- ----- ++ 19 | ```; 20 | let ourNum = "605e4e59005b40455f5548521a655f58494200524f4940585f"; 21 | let uniqueChars = toscalar( 22 | range i from 0 to strlen(logoString)-1 step 1 23 | | extend ch = substring(logoString, i, 1) 24 | | where ch != '\n' 25 | | summarize make_set(ch) 26 | ); 27 | let arrLength = array_length(uniqueChars); 28 | range i from 0 to 24 step 1 29 | | extend ch = tostring(uniqueChars[i % arrLength]) 30 | | extend ch_code = tolong(unicode_codepoints_from_string(ch)[0]) // Get ASCII code 31 | | extend hex_byte = tolong(toint(strcat("0x", substring(ourNum, i * 2, 2)))) // Convert hex pair to number 32 | | extend xor_val = binary_xor(ch_code, hex_byte) 33 | | extend decoded = unicode_codepoints_to_string(xor_val) 34 | | summarize Message = strcat_array(make_list(decoded), "") 35 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-54.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAFWTXW7UQAzH3/cU1gpEi1Kp21I+ihBC4qVUvQBVVXkn3mTIZCaMnaZb8cAhOCEnwZ5ZhHja2fjnr7/tQAKfURA+QKs/gttAcHTVXvooDVzT/pIl+9gdr25XG2hg/SX5qP8LDYuXHnYBfQaMLfBE1K6b1ZmBc3TpgcwXJhShHBlmpswQK3VuFM/jiNk/EUim2HIN6QKpK/DgQ1DylZHiRzpRf08MI3beNbUG6bNSrNiFYc/08doe2HWZOhTFuceJ2hp6orwjJ+Awk6JvDI3Eovbvc43eJSt66akQb41I0lvlE2oH8PvnL1gItim0Ya+0Qu9KhXMu0rgeE4MKmFSbtKh5c2r2XjUKBoTUMQQ/EGCW3Rxgyokt16ZITOh6NUfVhEKotaCAFxhiWqzTTVE4EwZNw77rRZsUDQaak/uas+j73F5Fv+uZ1bj4J8wqs8bTlsCl0uPmok5MMHYl4Ug6dcdNKbUpwx0PaBGXiap/0KimjEujdhP8Q2GKqlo8WZy9FdVTmLQdHLkMrGJVWp30g6fFDFrViIOF1iLY1gCzgUXel7ZZByHdoEk/wg3ut3Ue21mAfXR1ZmdFR4wY9qJtgGdIc4YOx2It6rnUUk2pSXQ3URVURUdrPx7AIuHg3VDErWvP/TaZhA247Hkq2kRCMb4IrasbIU18aHdHFIpW2wNUtM5zPKyAC8kNS8pD6cNhfCGK/qXv3q/sPFc/gB5FDwSuxklvledtvcsjPdEGThvYHP/HnCnkkOnI+BHF9brYeg/0COvbTydf8eTpbt0YqcXA2pz/naJ+PVd/G8V98CwW5MwQ3dNvdjw3xIwdWSGSHco95ox7w8413Pr4D7TLNYhWBAAA) 2 | 3 | ```kql 4 | let Data = datatable (Id:int, Key:string) 5 | [ 6 | 1 , "Joining data with flair and speed", 7 | 2 , "uncovering patterns users need", 8 | 3 , "summarize trends with clever skill", 9 | 4 , "time-series magic, data thrills", 10 | 5 , "$", 11 | 6 , "aggregates shaped with perfect care", 12 | 7 , "nested queries going where", 13 | 8 , "others pause — we boldly go", 14 | 9 , "turning chaos into flow", 15 | 10 , "handling logs like artful prose", 16 | 11 , "each line telling what it knows", 17 | 12 , "real insights start to show", 18 | 13 , "%", 19 | 14 , "Kusto wizards at the core", 20 | 15 , "untangling metrics, logs, and more", 21 | 16 , "see the clusters come alive", 22 | 17 , "telemetry to help teams thrive", 23 | 18 , "overviews that make things clear", 24 | 19 , "*", 25 | 20 , "hackers? Maybe — but sincere", 26 | 21 , "analytics is our game", 27 | 22 , "code that earns a streaming name", 28 | 23 , "kickstarting dashboards, crisp and neat", 29 | 24 , "even ops teams feel the beat", 30 | 25 , "runs like clockwork — can't be beat", 31 | ]; 32 | Data 33 | | extend Imp = substring(Key, 0, 1) 34 | | extend Imp2 = case(Imp matches regex "[A-Za-z]", Imp, " ") 35 | | summarize Imp3 = make_list(Imp2) 36 | | project Message = strcat_array(Imp3, "") 37 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-56.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAK2UT4/TMBDF7/0Uc0GbQFqcP05i0B44ICGQOHFbcUiboY1InSj1sq60H55nZ7cqu1V2I9GqzsjO7z137JmWDXG95QNdU10ZfNctB/bDwFUb0dE/wxshROR+5AalVERuOAWY/Un3xNawrul7tWeoXX3SndnxcPVx0cLE9piLx9h0/Q+8jIl+aDTWEA2V3nJQwEPlGGwfLu5p/2fJtq8gagGROfbc/Qr8nhYnvyPoTXXgYEH4WFqzuWPW0KLVimIpQ2gKQe8oCAJL7502vaEkDOktLWMpoicgEE+W02QpnpOlJ5NCzPVMlN9tWjpyGRflBIuVAqF9qgHYaWRitjsQTypHpvkL5suL7jL2GjKbdr+QNSCOLGL/32Uy7Z5cMi/SUSKfbQ7EkconTRby9UlTY9JU+kpPVMoKr/r4sUa+3R5M91Ah686Ybj9RGEjQfy2MHPtO5Ixrkqa5vyZZNjdX/xxxnGcvXLCzMxbPcval2vw+tZUxaZ/RwaYaGN3QqYU9NCy60LG+4jSge6ubTj82qWhsj9HZ8UR0Zot0D9DggdpG82ZXDYbuGrOjoOUtFq53TV2zDv8Cck1e/GkFAAA=) 2 | 3 | ```kql 4 | let edges = datatable(x:real, y:real)[000,000, 000,999, 999,999, 999,000] | extend Name = 'Another'; 5 | let xp = 1; 6 | let topText = print x = range(70, 960, xp) 7 | | mv-expand x to typeof(real) 8 | | extend y = case( 9 | x between(70 .. 155), 900 + (((x / xp) % 2)) * -150, 10 | x between(155 .. 185), 900 + (((x / xp) % 2)) * -800, 11 | x between(185 .. 270), 900 + (((x / xp) % 2)) * -150, 12 | x between(290 .. 380), -1780 + (((x / xp) % 2)) * -150 + 7 * x, 13 | x between(380 .. 400), 900 + (((x / xp) % 2)) * -150, 14 | x between(400 .. 490), 3680 + (((x / xp) % 2)) * -150 + -7 * x, 15 | x between(510 .. 540), 900 + (((x / xp) % 2)) * -800, 16 | x between(540 .. 710), -520 + (((x / xp) % 2)) * -150 + 2 * x, 17 | x between(730 .. 760), 900 + (((x / xp) % 2)) * -800, 18 | x between(760 .. 900), 575 + (((x / xp) % 2)) * -150, 19 | x between(900 .. 930), 900 + (((x / xp) % 2)) * -800, 20 | 999.0), 21 | Name = 'Kusto'; 22 | let bottomText = print x = range(70, 710, xp) 23 | | mv-expand x to typeof(real) 24 | | extend y = case( 25 | x between(70 .. 156), 250 + (((x / xp) % 2)) * -150, 26 | x between(336 .. 444), 575 + (((x / xp) % 2)) * -150, 27 | x between(540 .. 710), 1640 + (((x / xp) % 2)) * -150 + -2 * x, 28 | 0.0), 29 | Name = 'Hacker'; 30 | let bottomEdge = datatable(x:real, y:real) [ 000,000, 999,000 ] | extend Name = 'Just'; 31 | union topText, edges, bottomText, bottomEdge 32 | | render linechart with (legend=hidden) 33 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-16.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/ContosoSales?query=H4sIAAAAAAAAA7WSPQvCMBCGd8H%2FEDop3KBN2ijiICIYFQW%2FdpUiwWLFpv5%2BW7mqg14UzTtlePrk7m3iyDDNuox5SqmRKjLBzDBrzAAzxqwwC8wSU37ndaqVONfHpV450Sdu9Zdv9fOv9JFd3%2Fth%2BgOh778rZ%2FqxPnPbfepWb%2F6oH754mMXLdDP96ayPeT3mvNuYWppt85M%2B7msaODTrwKoV9pwHEEMQ3oj3SAKhsCAXkP4N8ZhHXBaB36bHOYCQNJGBFDSRgmzShAHZoIkEeKsgiI0Fv29MrSNIjQbRtgCBtABhYAGwMHLSshLrvyN29X3brtwCcHpXLL1%2BBY6qFZWjBgAA) 2 | 3 | ```kql 4 | let i = "IIIJIIIIILLLLLLLLOOOOOOOOVVVVVVVVEEEEEEEEKKKKKKKKUUUUUUUUSSSSSSSSTTTTTTTTOOOOOOOO"; 5 | let l = "IIIIIIIIILLLLLLLLOOOOOOOOVVVVVVVVEEEEEEEEKKKKKKKKUUUUUUUUSSSSSSSSTTTTTTTTOOOOOOOO"; 6 | let o = "IIIIIIIIILLLLLLLLOOOOOOOOVVVVVVVVEEEEEEEEKKKKKKKKUUUUUUUUSSSSSSSSTTTTTTTTOOOOOOOO"; 7 | let v = "IIIIIIIIILLLLLLLLOOOOOOOOVVVVVVVVEEEEEEEEKKRKKKKKUUUUUUUUSSSSSSSSTTTTTTTTOOOOOOOO"; 8 | let e = "IIIIIIIIILLLLLLLLOOOOOOOOVVVVAVVVEEEEEEEEKKKKKKKKUUUUUUUUSSSSSSSSTTTTTTTTOOOOOOOO"; 9 | let k = "IIIIIIIIILLLLLLLLOOOOOCOOVVVVVVVVEEEEEEEEKKKKKKNKUUUUUUUUSSSSSSSSTTTTTTTTOOOOOOOO"; 10 | let u = "IIIIIIIIILLLLLLLLOOOOOOOOVVVVVVVVEEEEEEEEKKKKKKKKUUUUUUUUSSSSSSSSTTTTTTTTOOOOOOOO"; 11 | let s = "IIIIIIIIILLLLLLLLOOOOOOOOVVVVVVVVEEEEEEEEKKKKKKKKUUUUUUUUSSSSSSSSTTTTTTTTOOOOOOOO"; 12 | let t = "IIIIIIIIILLLLLLLLOOOOOOOOVVVVVVVVEEEEEEEEKKKKKKKKUUUUUUUUSSSSSSSSTTTTTHTTOOOOOOOO"; 13 | let oo = "IIIIIIIIILLLLLLLLOOOOOOOOVVVVVVVVEEEEEEEEKKKKKKKKUUUUUUUUSSSSSSSSTTTTTTTTOOOOOOOO"; 14 | print strcat(substring(i,3,1), 15 | substring(l,56,1), 16 | substring(o,64,1), 17 | substring(v,72,1), " ", 18 | substring(e,29,1), 19 | substring(k,47,1), 20 | substring(u,74,1), 21 | substring(s,71,1), 22 | substring(t,70,1), 23 | substring(o,38,1), 24 | substring(v,43,1), " ", 25 | substring(k,44,1), 26 | substring(i,49,1), 27 | substring(i,57,1), 28 | substring(i,65,1), 29 | substring(i,74,1), " ", 30 | substring(t,70,1), 31 | substring(e,29,1), 32 | substring(k,22,1), 33 | substring(i,43,1), 34 | substring(i,37,1), 35 | substring(v,43,1)) 36 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-57.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAI1TTW/UMBC951dYOSXgSp582abigNQDgr31WK1WbmLRQJKNEhdYPv47M5PspkCF0K6ixH7z5r3nceeDuPH1sfHitUiaV6I5Da5v6zT6Hgkh7t3sq+LQMOIQjnOY2uFD8ji0vECP8dgOYca9w7rZpGn08zrqkPnW15MPM1I3LuDvvvPUYwGm0R21ELEpJCgtSy0NSFNKU0ldSFylF0VPo+lZWMQV0ir6pgrcrLioMNJkjM14A5SSOpcmJzoA3KqIr7LMAVpaI0uQVSUhU9LSGhYY4qFSY6gJAkCB1ESJcJRjqbEmtRUBNJAqUJbRisVRM6t5EQA3oaReKLGifyzFapmNIlXFylEYeQV6Zw0FJ5AvZpBHa86jlCVaUlyr2C87RFNYSDlVrJU92DU1UkSExrIqbZh0CRGf5BwFa1gqIacvMpMp7mwNl5Wkw1JUGA5FkGVLytyXza+JFaSRggOV/+m62mJS3FyVfAh4Ilu4oM6HwFEbOkl9LoOlzDKEymkzW3xqkqcXt5Ax8hJ8tF8m8sZ3be+Dn3Am46v4vEiD3KzTesvTifuXcceX2nVuSqIVEv0Q/mvwQyPmsWvDOvk05/ydNFLEMk4R1n++cuPYnYTvfO+HcIZcSo6DSDid+bHv3dR+88JNkzshsHef/KFr54AC8I4lKwVeL2L+8uCnM/bBzZva/AXol6DSTeRyfRukXJwmXEWArenut4ZrBUHG6fjR10/vMvapXTgwSbKTW6Zpmj4X6A4ZL9E8l/VTiutoxKUg3r15/5bOYHLD3Lngl5AuJv/ucKf26Tpo/0LBf6GyPYb8C2CyelgcBQAA) 2 | 3 | ```kql 4 | let Decode = (d: dynamic) 5 | { 6 | base64_decode_tostring(unicode_codepoints_to_string(d)) 7 | }; 8 | let Secrets = datatable(d: string) 9 | [ 10 | "84,107,57,81,85,86,74,84,86,70,86,87,86,49,104,90,87,107,70,67,81,48,82,70,82,107,100,73,83,85,112,76,84,69,49,117,98,51,66,120,99,110,78,48,100,88,90,51,101,72,108,54,89,87,74,106,90,71,86,109,90,50,104,112,97,109,116,115,98,81,61,61", 11 | "81,85,74,68,82,69,86,71,82,48,104,74,83,107,116,77,84,85,53,80,85,70,70,83,85,49,82,86,86,108,100,89,87,86,112,104,89,109,78,107,90,87,90,110,97,71,108,113,97,50,120,116,98,109,57,119,99,88,74,122,100,72,86,50,100,51,104,53,101,103,61,61", 12 | "86,50,104,110,90,105,66,117,89,87,74,110,100,88,74,108,73,70,104,111,90,109,100,105,73,72,86,117,99,72,104,121,90,81,61,61" 13 | ]; 14 | let Delimeter = "-"; 15 | let DecodedSecretsString = tostring(toscalar( 16 | Secrets 17 | | extend split_strings = split(d, ",") 18 | | mv-apply element = split_strings on ( 19 | summarize array = make_list(toint(element)) 20 | ) 21 | | where array has tostring(3*17+10) 22 | | extend decoded = Decode(array) 23 | | summarize L = make_list(decoded) 24 | | project Secrets = strcat_array(L, Delimeter))); 25 | let DecodedSecretsList = split(DecodedSecretsString, Delimeter); 26 | print JAKH = translate( 27 | tostring(DecodedSecretsList[0]), 28 | tostring(DecodedSecretsList[1]), 29 | tostring(DecodedSecretsList[2]) 30 | ) 31 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-59.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAF1UyW4TQRC9+ytKvtiWhkRhuYCMxAEhlgMHLgihqDxd4+m4p9vpxc6gHPgNfo8v4VWPnYjYB8/U9l69qvLlJX3rhZL4LL4VCh31vN+PZBNtxUvkLIY2I334+m3mJE/eteGM78bJ8pz5OuVo/XZFP2aEz/xTSZmOvXgaQ6HcW7+rudZLSlpdXEn2IA2xD7mXSEMYUEsZ3ISRECocExUvd3tpwcKNF/NmKv4x//39J5GzOyGmz4AKdFskjhTlIOxAhHprDNBzFE4lSmpo4J06lE8n4s7pPbc7wAPX2U4WCWK0UXJ6QPuOhKhVfwka4fxfH36R6UZ7ZeqcSFYEGUK2wdOmqDlJtJK0vrGpDYf62pBw21PwYGCMJqEFyECZ9wIpR40H01hJPVB5lyp9zwe7xWSQEUPZ9jWzDcPeyZ3NisbeUNuzc+K3iqZZxVd0SgPsKvIUto+hCwUP0wDS1GOUwcKmeWCi9TfCJWMxfH0LEaw5Ps7ky6Rm2lmAmpOqE7DDJL02aKQNRmr+nnOW6NN546qeDXUAVTVsPgM5RoN5GlAH6bxBmDqOHIfcqxmoxfuRDI9NbUndt8ViXRNnmzpu6zxq6E3Y0FEggIH4D+zf6zTO8xlP05kEaTBH6wxWcR/OlBKsWBKu42aKFtEK3BXXof+6BFhbpduelgbbJ6lOEztZ3EjHEEHf2QOiL+azn29m9bZm90jFSRkNMGs8R9C/xsiWi6Ve1X3d9/vT2dxPQq8WzcMRr1AClxcxjhh5vNYdyP1Sy63o7Zqu4B8Oz0CQTyiJ1vUXDmiAptqMcU0XXfPS6pEWXlHbIKXlJMuq36nIerr7eUNXzRP7iS5cz5+6aj9wvHjqmFqD5+XkeTVTGhVf/5LORDi1MKcyDBz1RnHsxeU16LcM4VSDpap/7dDbqZ2G5jRf/QMls8Nq/gQAAA==) 2 | 3 | ```kql 4 | // The sentence of happy is generated by GPT 5 | let happy=datatable(sentence:string) [ 6 | "Just when you think happiness is elusive, another moment of joy appears unexpectedly.", 7 | "It’s like a Kusto query revealing hidden treasures, making you feel like a hacker of life's secrets.", 8 | "You realize that happiness isn't just a fleeting emotion but a series of discoveries, each one adding to the tapestry of your life.", 9 | "As you navigate through the complexities and challenges, you uncover small joys and profound moments that remind you of the beauty in the ordinary.", 10 | "Like a skilled hacker, you learn to decode the patterns of happiness, finding it in the laughter of friends, the warmth of a sunny day, and the quiet satisfaction of a job well done.", 11 | "Each discovery, each moment, builds upon the last, creating a rich and fulfilling experience that makes life truly worth living." 12 | ]; 13 | happy 14 | | extend word=extract_all('(Just|Kusto|another|hacker)', sentence) 15 | | where array_length(word) >= 1 16 | | mv-expand words = word 17 | | distinct tostring(words) 18 | | extend ordered = case( 19 | words == "Just", 1, 20 | words == "another", 2, 21 | words == "Kusto", 3, 22 | words == "hacker", 4, 23 | 5 24 | ) 25 | | order by ordered asc 26 | | summarize result=strcat_array(make_list(words), " ") 27 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-58.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAHVUwY7TMBC95ysGJKQEDLUdJ3FA4cKFEwdW4oLQyk2mrSGxK8dlu4iPZ9Jmm+yBW2y/ee/Nm2mTzaY1fXvqTUSIB4TxaKI1PQQ8BhzRRTp6B36XbDb4m84jPbU+dNiBaYMfR4h2QAa997+s24OJsLMO3+6DsY6KOnp1I3GY3sbHdwDfLD5cpVoTI4b2YEJ8l/QYYRZooDOka7Y9ptG2vz75k4vve+/2GXxPZFHngheikkozqbWsKyFlXVa5FCVnsqg0l1XNVSnpUCtRlLlQkrPkcqqKuqhLxSRVVaUmHqWk4PV8U9S80mWtC07lRa5knZNcKeVcXnKRa6nmpyIvNXHltapkJUvJJztKsbLSkqtCS5nrWpKrROW1JkuKkyYjVbIriryWKldC84JRC6UWBa8rKZMf8BdGDDQH+wfpG88RXQe3KJvgH+7dadhiSLMPl+imnL4at8cmegq2NyG9pklMp2EwYWIaXDNYt2SaseHcDOa8ukluaq4ZY6ARpdEf8JwO54zNXy7LyNQx+J/YRnCzg5u7aYBhsgId7IIfgEP0UOYwRjyCWPpBu0f3mzh8aMSVxJzt+MUMuHDYFQcZ6vHq/9JrNlMupqf6hjreEpS2cYEyy8SquZtZ0ol+Wq107vYlP79kEw01+SFZ/PyFn946oB3vqMY6h+FpX4nlxkcS048jwPaRrJux/U+7yYqvubKtAiTGFXqxfUfSW+tMeLwfD3YX73vcxVSwbtXaZ2hmiHHdMll2N2EeDhgQPr9o+OLraKeG4BWIfBVkaOm2NSNCaj829Mb4swTx1JPnBtKjfS14Bm8A9FtIO+LRK9hg9s7GU4fQpMQ5Qd9MqM0zFGU/DcnhOF4GMk/vYopPuKdlu6iyGylbFRIqEBeZWv+xwIONB0h7JFDXHGzXoYPsH/KaJor3BAAA) 2 | 3 | ```kql 4 | 5 | //calculate the spatial representation of 6 | //events recorded across time, looking at fine-grain 7 | //dimensionality. View the scatterchart. 8 | let events = datatable(tickCount:long) [ 9 | 259310517248,28829712296732160,257802790462,259415631420, 10 | 259417595964,27127685174421094,27127590786985062,534293931622, 11 | 259416013824,534293536864,3947272620882944,6782045822389260, 12 | 439804640768,851673153924341805,122681509722 13 | ] | serialize | extend dimension=row_number(); 14 | let tickRange=toscalar(events| summarize mn=min(tickCount),mx=max(tickCount) 15 | | extend n=strcat(tohex(mx),tohex(mn)) | project n); 16 | let dimensions = range d from 0 to 63 step 1 | extend eigenvector=1; 17 | let axisNames = range i from 0 to strlen(tickRange) step 1 18 | | extend axis= substring(tickRange,i,1) 19 | | extend dimension = tolong(strcat("0x",axis)) ; 20 | axisNames | join kind = inner events on dimension 21 | | order by i asc | extend eigenvector=1 22 | | join kind=inner dimensions on eigenvector 23 | | extend S = binary_shift_left(1,d) 24 | | extend H =binary_and(tickCount,S) 25 | | where H!=0 | extend pi = i % 13 26 | | extend arc = case (i>= 13,0,1) 27 | | extend euler = (pi*10) + 8- (d % 8) 28 | | extend magnitude =(arc*10)+ (d / 8) 29 | | extend strangeness = tostring(i % 10) 30 | | project euler,magnitude,strangeness 31 | | render scatterchart with (legend=hidden ) 32 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-60.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAI1UQU8TQRS+8ytee6E120aPHgiChAjFBIQYFUwz7U67A9OZMvPWZYkH4smDFiEexEsvHjQm6klJPPhf+gfsT/DNbFu2UZCk291989433/veN9s1QuFMcWm1XttYK848B36AXIWwEXOu5qA47J+c0PVl2D/+OTh6PTh78fv8GJjhkOoYDGdhGkDE6W8qBi1tACNh52HY752PL1hQGiNuQCsODYHcUhIHqdvXTMsxfCikZG1eX+e6K/lMxnWaJwU+jQLD/vtTev1Br7/y69+mG1vBWQutWAFq2I+5SSERGEGtUqtsVNYKwf/WH5MATaagJSRyM2ZtAxgv7GqhgBH9rIsAFmMhQ2AjNIwYQshbtGQL1RUcHJ1ZuGJDGKVckbFsdAc2uUKhuHRJj5YeeD5UKCVthryJtDHNDS0ozozn12KmkFN7odFgMOck/ujV7H1w4l48/iMK91hzj0ToCOYsQvZIOLQ1sDYjDTop/SiuE68LLRluhUVI2fxUZahp/ALBulRfOx+MitNMVGoEoUH0HahNLfJOwfnpe47/oomVrt9nxoJ3Su/Mz79H/jj9TCCx9e6dJZasww6FagewG1ucjNBv1qV6XoAk4irzeuzvJhM+AKW9ZSMROstq7VWcaGuRpYSVBI0Ys7K9fQltilgYHL29hMXqJSxyzd3VMlyXBO4G9OrlsP/mnROU0EI3cBNL7hESbSRZzgMlOibfSc3CrB03G/Zskhe6ZhKgQdVof+2WM3MZ0Y4wGLfUYs5COlEu05WGdPpBt0C5tGq16ubwNUd1WRiL9S1DA6ZBUJCesHSnuNMobS9UnjzdZpVDd79R3mkUA7gV5CZXvoDZ5E2twgkOahKRm9KleDcrt0eQhOi/beUc2lYkzAjsepzGgucwlmmeGP0NUsq8XM4K3TGaasNaoRV1YNE0GZZy8gRFKAb5Pn0gR9W/57d1wF2jd915HiH/Aati/TTfBQAA) 2 | 3 | ```kql 4 | print 5 | "DJ_KQL" 6 | | extend Queen= "👑👮🏻‍♂️ are you ready, hey, are you ready for this? 🎸🎸🎸 Another one bites the log 🎸🎸🎸 Another one bites the log" 7 | | extend Village_People 8 | = "👮🏻‍♂️👩🏻‍🚒👷🏿‍♂️👰🏻‍♂️ It's fun to query with K-K-Q-L!,It's fun to query with K-K-Q-L!,You can filter the logs, You can join and extend, Build a query that defends!.It’s fun to query with K-K-Q-L! It’s fun to query with K-K-Q-L! From Sentinel to XDR, You’ll detect threats near and far!" 9 | | extend Abba ="👨‍🎤👩‍🎤👨‍🎤👩‍🎤 Hacker mia, here we go again my my, how can we resist ya? Hacker mia, does it show again?,my my, you can’t beat my system! 🎶" 10 | | extend Bruno_Mars = "🎙️🎩💫 cause you're amazing, just the logs you parse! when you run your query, no one hides too far! threats stay low,but your kql glows — cause you're amazing, Just the logs you parse!" 11 | | extend ColdPlay ="🌈🐘 we used to rule the world, logs would load when we gave the word, now in Kusto we query right,threats fall down in the dead of night... 🎯" 12 | | extend First_Track = extract(@"\b([A-Z][a-zA-Z]*)\b", 1, Bruno_Mars) 13 | | extend Second_Track = tolower(extract(@"\b([A-Z][a-zA-Z0-9]*)\b",1, Queen)) 14 | | extend Third_Track= extract(@"\b([A-Z][a-zA-Z]*)\b", 1, ColdPlay) 15 | | extend Fourth_Track= extract(@"(Hacker)", 1, Abba) 16 | | extend Session = strcat(First_Track," ",Second_Track," ",Third_Track," ",Fourth_Track) 17 | | project Session 18 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-61.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAGVUTY/bNhC9+1dMdVkZULuS/M0g6CFAWnd7SJEFcggCY0SObGYlUiCpdZSkQP9D/2F/SUeSvbZb62Bo5s2894ZD3d/DL44oaLP3CTy0Plh4i8b/MLm/h1/xmaCzLdAzOTiiCaSAAcExorSuBlt42TqC7bvnJaBSjrwnD9owypN0FOBoneLWfT9pzece7RuUjLJtAFtCOGgDqF0CaFRPZYAq2jNb1QFWganDgUCiZ5HAtCDJBeSiuvOc1bb13Lo1wWnyP/dEH6iqEijoYCs1FB/1V3TKdRyr7HEw90EHw2r7tO8NXMmXtib2uSfOud7w8aB9c9Jx0EqxxObgkOv++etv1lhBY4/keDpFN4Baw4NsGiwqghr3WvZGH/74fVLxRB4PjjBseZpVpfdkJMFrUBj4YXzcz1J4NmP2048T4F+Up2km8mUqhFyvoiTKMc1FmUkO5Gq16CMDYs2BzeICITXnCC5IRcnYqaQek1GRi3NoKJ1x83macm6sRbEuuRbP73Mh5+dsjy+LVGTpcnHO5wKL9Skv01KUcr0RtBBFVojsAlpsKBWpWLGE/EWSUoWYbWYrcStpPivXzHHhVGUmSL5InIl1cS1JkRLyysJMZBmmI/vYlllvGFTJDheXDtlMrsQyTYtrzpxpLqRLsZm/vHDzJV2ZpmK55rdPr8Zj3r5D53lrXkP8uBU35zr9Nsh43A5/34G+BOLlf29bJ+nNsMsd1+3J7rQp7a50tt7pZnfa0aHX9Kdx6btTj8bZzyTDj09EzW2nyZ+vJv9fusl3vqfP9olelMbTyUVKQBcG8b4tRtXxTdME0gSyq4qPd2/1F3gzXNO7T1zIN5biQdytL23i6Dds0PDcHsh0GE2TM994PNpT3YTulpBB0e50fsFW/YWLT1XTXsbZPx6xg/9IPeEY5du6Rqe/Erwfv09sMDiJYYfOYRfX+ES7SvsQ3/qZJlF0PZ5zsaOm4q/Z7jyiIT4qhTu4m8K/thOBAGIFAAA=) 2 | 3 | ```kql 4 | // Greetings, Kusto Fans! 5 | // Have you ever wanted to transform obscure IPv6 addresses into secret words, 6 | // conjure spaces out of thin air, and even elegantly alter the casing for certain mysterious countries? 7 | // Well, behold the wizardry below! 8 | // Witness these IP addresses come together to whisper the hidden phrase – all powered by the unstoppable magic of KQL 9 | let ThreatIntelligence = datatable(IPv6:string)[ 10 | "2001:260::c87","2a02:f1c0::2d75","2001:280::9587","2a02:ed40::a5ed", 11 | "fe80::1eb2:", 12 | "2001:360:4000::","2a0a:8f40:a::","2a04:c400::","2001:fb0:1065::","2a02:ab80::","2c0f:fc89:e5:b1b:1::","2a02:59e0:0:7::12", 13 | "fddb:3937::", 14 | "2001:43f8:10::","2001:df1:ec0::","2a03:8b00::","2001:ded:c000::","2a03:11a0:1::", 15 | "::1", 16 | "2001:df0:a5::","2001:13c7:600b::","2001:df2:8bc0::","2a06:940::","2a00:16e0::","2c0f:eb68::"]; 17 | let TIParser = (TI:(IPv6:string)){ 18 | TI 19 | | extend SourceCountry = geo_info_from_ip_address(IPv6).country 20 | | project-keep SourceCountry 21 | }; 22 | ThreatIntelligence 23 | | invoke TIParser() 24 | | extend Starter = substring(SourceCountry, 0, 1) 25 | | extend ['Fix Casing'] = case( 26 | SourceCountry in("Japan","Kenya"), Starter, 27 | isempty(SourceCountry), "_", 28 | tolower(Starter)) 29 | | project-away SourceCountry, Starter 30 | | summarize Secret = strcat_array(make_list(['Fix Casing']),"") 31 | | extend Secret = replace_string(Secret, "_", ' ') 32 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-11.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA2WUbW%2BjRhDH3%2FtTrPoG06NSgnHuLqepeqQyIU0tnX0HgTiyFtgC8bIQHmxA9%2BE7ix9CVSQEDDM%2F%2FvOfXTiryZ%2B0pgRIhJeaBpyRqR3dpqLWyF%2Bsu63qMhWxRlyWxkl9jDuUN%2ByWHF%2Bpk%2BcJweNaI0TJOkUj58PQNaL42YK6UQ7QRBZvItfZ2dai8e9MKIIrfJN4WcttK%2BJB5nTe06oIdEPRBqIuidHrmDhDYhzono8Fj3cmZ9aS%2B%2B6qt%2B9Xub82e2p97qI7U%2FfdhAeu03g6%2FJD5J%2BJMEg803F2Yxg0Srfk%2BgrVw%2BugrgFibB%2F8J1WXRdQBgLTr73kzC2bIAlBb74mEfrB%2FgRDQkMf9nrPEKiZGV2NYSwmyeANURr7f8WyVVegCxJ3axly3O6nzLqbIVPxHnklgVSSra6og1MKT0Pjz5nosoK%2BFhDBCa%2ByBrYW5bD3gmBUY6s%2FPdBUCPQh%2B%2Fu2eNN5LI8z2rzjKNj5JoW6sinK0AG6VPSxxJygDMK2qtZ2iF9Ql4Pz8ElgOA7Tuejx89ET9KYpDG720b13IyqK%2Fz1wbgFTUtkxDQgABnLTES0vnfAKSBJvZxZxbBmfhJEt8aWtb9CWqgtYp9v8Qck1qLV6o73RUAtX7EHuifEYDDQStSMwkg47XnttDjmpgh8eXLhOPK%2FhrHJYtpzSJc33KZT85yfxLW1kxEcol%2Fz3dMVJiBoZKG9ZZyPlWmm81BVYY9oJJRXbb%2FjbUFxdLppVYdva%2BaLKNl2jOyKNkbUsO8EfVUJUFH6vy4ZUaV5401IhwSVjISpIKW3bbNy%2Bno9pisDWysNXSV%2FE5mo%2BIorepUhDUZZ06%2BTN6tmPwkr3kqyC4VEaRCsLIR6VvDjv%2BBXJwFXSxa1zgVbOR%2FMsiHgT7I0MgjE5hkkF%2FJdOj8A7lWEVKU%2BStDPStWNbyWNge0YjfGNmJhHrHtxZOqCU53w%2B9FO3534KoS9G7s36yqaMwQVbKC05BtsTXWTv%2F7dAFndMe2HH2ZnjSoqPYPZfPLRsP5KkQZHp83zxh5eZEhRf0X4RirbxgFAAA%3D) 2 | 3 | ```kql 4 | let Data = datatable (Id:int, Key:string, Weight:int, Value: string) 5 | [ 6 | 1, 'my', 42, 'ZmFaWdo==udGludWVkIGFuZCB=pb0aWdhYmxlIGdlbmVyYXRpb24', 7 | 2, 'dj', 43, 'gb2YZGdlLCBleGNlZWRzIHRoZSBzaG9ydCB2ZWhlbWVuY2=Ugb2Y', 8 | 3, 'wack', 46, 'G5vd=SnVzdA==nSBwZX=pbmd1b==GFyIHBhc3Np=b24gZnJvbSJ=', 9 | 4, 'of', 40, 'dGhIGN=cm5h=a25vd2xlQsIHRoY==gYnkgYmFuY2=Ugb2ZGVsmRl', 10 | 5, 'sphinxs', 45, 'zZ=XZYW5vdGhlcg==cBvbmx=5IGJ5IGhp==cyByZWF==zb24LTW=', 11 | 6, 'loves', 47, 'zIGRpc3R=md1aXNZCBie==B0aGS3VzdG8=lz5wbGV==hc3VYZg==', 12 | 7, 'big', 41, 'gYW5yZS4=YW55IGNhc=m5hbCB=wbGVhc3VyZQ==JvbSBvdGCBpb=', 13 | 8, 'quartz', 44, 'IHNpb=BaGFja2Vy0==aGUgY=29Bvd==GhlciBhb=mltYWx=zLCB3', 14 | ]; 15 | let Aggregated = Data 16 | | extend KeyTokens = extract_all('(\\w)', Key) 17 | | mv-expand (KeyTokens) 18 | | summarize Freq = count() by tostring(KeyTokens), Weight 19 | | where binary_xor(binary_xor(Weight, Freq), 42) > 3 20 | | distinct Weight, Freq 21 | ; 22 | Aggregated 23 | | join kind=innerunique Data on Weight 24 | | extend Start = binary_xor(Weight + Freq, 42), Len = 4 * (Freq + 1) 25 | | project Results = base64_decode_tostring(substring(Value, Start, Len)) 26 | | summarize Message = replace_regex(replace_regex(tostring(make_list(Results)), @'\"\,', ' '), @'[\[\"\]]', '') 27 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-62.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAI1TTW+bQBC9+1eMUKSASiND0sRN5VNOvedWVWgD45gYL3RZrKTqD+ih5/7A/pLusB8ebFQVyfb6zcybx5vZBjWgLNsKq8+yGzSsoVO11FAJLWAB5llDlC2z5dJ88mwJ+XjK6AscOp4JHwMjno8VFs/C2fzmjmrEj2deawlDzrGXbz3HT3//Sxvvy3lO+zLcvvnytNestujTojGekqOP4qlBYx9Zqekc12TxvbE3hU5ojUre99rY/Zwsvoxe335MASJGHaV2CHc5BZhGH7i9cwEvMlR88FROsQ+srlkFp1q5iuChD1y75sGs0Jz3mMhdBbnZNHBjA0FwaM5e0BrpK46WTKlWN16uGy0Fvlr7FR5Q9fjAphAmsvhhVrx9wVL7IaQwDsaWOuxhO8hdb+r47TCl+KpRVj6LEvquqXVMQ04hgigBMGn7w3t87QTP1C3otw7bTexmDv96mMpyK1ThaOh+OkIrt8Lp5eXqDcdLW0vY1bJa11KiOjemlXDR4EZfTbus4ULVz1t95RAmh3nlmj8aU2jPcc4p4hWl4TAZg6wppaCvzijTfaHbwtphL0diCvthvxeq/o6wx74XzzQ9k1MKXQilxFu8FzssmrrXcSBPjPdRYlUd6n4QzYwZTpGNM0cVdo0o0QsZt2sOm8G5a0YC7SDtgFtReqKMsD+/fwU0yi3yM0qOor4NrcaKibJvHF9Gl+mJ4hQMODVqMzTNWe2ZW9MeZBm8A3JtfseDj7rtS9EIFVuEqXYjL46DCrlsNxK2PScV/t3+AhXuWjyIBgAA) 2 | 3 | ```kql 4 | let encodedInput = print data 5 | = "10100010210 20001010010 10001020010 20000101010 10201000010 20101000010 10020100010 20100100010 20000101010 10020010010 20100010010 10020001010 10201000010 20101001000 20001010010 10001020010 20000101010 20100100010 10201000010 10020010010 20101000010 10001021000 20101001000 20100010010 10020001010"; 6 | let codeTable = datatable(input:int, pattern:string) 7 | [ 8 | 69, "20100010010", 9 | 72, "10020010010", 10 | 67, "10001021000", 11 | 75, "20101001000", 12 | 83, "10001020010", 13 | 85, "20001010010", 14 | 32, "10201000010", 15 | 65, "20101000010", 16 | 78, "10020100010", 17 | 74, "10100010210", 18 | 82, "10020001010", 19 | 79, "20100100010", 20 | 84, "20000101010", 21 | ]; 22 | let reverseCodeTable = codeTable 23 | | project pattern, input; 24 | let patternChunks = encodedInput 25 | | extend patterns = split(data, " ") 26 | | mv-expand patterns to typeof(string) 27 | | project char_pattern = patterns; 28 | let decodedInput = patternChunks 29 | | join kind=inner reverseCodeTable on $left.char_pattern == $right.pattern 30 | | project input; 31 | let decodedText = decodedInput 32 | | extend character = unicode_codepoints_to_string(input) 33 | | summarize message = strcat_array(make_list(character), ""); 34 | let visual = patternChunks 35 | | extend visual_pattern = replace_string( 36 | replace_string( 37 | replace_string(char_pattern, "0", " "), 38 | "1", "▌"), 39 | "2", "█") 40 | | extend quoted_pattern = strcat('"', visual_pattern, '"') 41 | | summarize full_pattern = strcat_array(make_list(quoted_pattern), " + "); 42 | encodedInput 43 | | extend visual = toscalar(visual) 44 | | extend decoded_message = toscalar(decodedText) 45 | | project decoded_message, visual 46 | ``` -------------------------------------------------------------------------------- /SECURITY.md: -------------------------------------------------------------------------------- 1 | 2 | 3 | ## Security 4 | 5 | Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/Microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet) and [Xamarin](https://github.com/xamarin). 6 | 7 | If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/security.md/definition), please report it to us as described below. 8 | 9 | ## Reporting Security Issues 10 | 11 | **Please do not report security vulnerabilities through public GitHub issues.** 12 | 13 | Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://aka.ms/security.md/msrc/create-report). 14 | 15 | If you prefer to submit without logging in, send email to [secure@microsoft.com](mailto:secure@microsoft.com). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://aka.ms/security.md/msrc/pgp). 16 | 17 | You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc). 18 | 19 | Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue: 20 | 21 | * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.) 22 | * Full paths of source file(s) related to the manifestation of the issue 23 | * The location of the affected source code (tag/branch/commit or direct URL) 24 | * Any special configuration required to reproduce the issue 25 | * Step-by-step instructions to reproduce the issue 26 | * Proof-of-concept or exploit code (if possible) 27 | * Impact of the issue, including how an attacker might exploit the issue 28 | 29 | This information will help us triage your report more quickly. 30 | 31 | If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://aka.ms/security.md/msrc/bounty) page for more details about our active programs. 32 | 33 | ## Preferred Languages 34 | 35 | We prefer all communications to be in English. 36 | 37 | ## Policy 38 | 39 | Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/security.md/cvd). 40 | 41 | 42 | -------------------------------------------------------------------------------- /resources/participating-queries/query-63.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAJWV0W6bMBSG7/MUFlcgsSmEZkjbMmnqbqp26rZW2kUUIQdM4tZgZJslrO277xgMhSYSHjeGw+f//OcYG0YUuv55E9+QI014gVYorQuc08RdzxBcTin4A0mU4+unNiSrPMeC/iU62IYeOC1apKeuK6l4F2tDjKgeMqHDnggypkpBCzUO7XHySIRjQhvv0wyk0FcpSb5ldfyD4VPnTyDufEQLHzkUxjmMGYxOVZZa6qXzbrjAcEHzZnyd4+YTXGi4cIJ7pxOeS3AxMXFhmWBuuMUEd2HJLS0btbTU+2Cpd9Ko8D9XYipBaGnYdmVDy4U8KSyyLCyyLCyyLCyyLCyyLKzjlujlLdZuYoGLHUF3ipQoEzyHghVHWAhcx4wUO7V3R1vcg05JDQezZ0SOihQpuiqkgq0/4tZacfPK/OYivUqPgCnOeLFz9aT3B2+okpLjrfiOBRwzwFGauVQWFWMtSz0flskfzafeQOAeSpEZF3mTRCo4wgyWDahf+HC5xzpBgiVxZ20rOntfVnqvymprpvc6g/N5beANGBqZ9lHg+W8EPzd7Hzld3HHM+gwsnfEzqGXVHZe69ObONTX0ycY04wdDN3cndNeBVx/gFVq+rdvPAMsEYv0PprEnwV+OH0nMqFRuI6f5bwDV8CoAsWdkflPoUhCs6B8S31aqrPSnAU1MsIqbz6qZLaEpjvcPPdsNLvkGAAA=) 2 | 3 | ```kql 4 | let KQL_Lexicon = dynamic([ 5 | "project", 6 | "summarize", 7 | "join", 8 | "Kusto", 9 | "let", 10 | "where", 11 | "print", 12 | "hacker" 13 | ]); 14 | let Assembly_Plan = dynamic([ 15 | { "w": 2, "i": 0, "f": "upper" }, 16 | { "w": 1, "i": 1 }, 17 | { "w": 1, "i": 0 }, 18 | { "w": 3, "i": 3 }, 19 | { "w": -1 }, 20 | { "w": 1, "i": 4 }, 21 | { "w": 2, "i": 3 }, 22 | { "w": 0, "i": 2 }, 23 | { "w": 4, "i": 2 }, 24 | { "w": 5, "i": 1 }, 25 | { "w": 5, "i": 2 }, 26 | { "w": 6, "i": 1 }, 27 | { "w": -1 }, 28 | { "w": 3, "i": 0 }, 29 | { "w": 3, "i": 1 }, 30 | { "w": 3, "i": 2 }, 31 | { "w": 3, "i": 3 }, 32 | { "w": 3, "i": 4 }, 33 | { "w": -1 }, 34 | { "w": 7, "i": 0 }, 35 | { "w": 7, "i": 1 }, 36 | { "w": 7, "i": 2 }, 37 | { "w": 7, "i": 3 }, 38 | { "w": 7, "i": 4 }, 39 | { "w": 7, "i": 5 } 40 | ]); 41 | range Step from 0 to array_length(Assembly_Plan)-1 step 1 42 | | extend Inst = Assembly_Plan[Step] 43 | | extend WordIdx = tolong(Inst.w) 44 | | extend IndexOrMarker = iif(isnull(Inst.i), -1, tolong(Inst.i)) 45 | | extend Transform = tostring(Inst.f) 46 | | extend RawChar = case( 47 | WordIdx >= 0, substring(tostring(KQL_Lexicon[WordIdx]), IndexOrMarker, 1), 48 | WordIdx < 0, " ", 49 | "" 50 | ) 51 | | extend Char = case( 52 | Transform == "upper", toupper(RawChar), 53 | Transform == "lower", tolower(RawChar), 54 | RawChar 55 | ) 56 | | order by Step asc 57 | | summarize Chars = make_list(Char) by Dummy = 1 58 | | project Creative_Output = strcat_array(Chars, "") 59 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-64.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAI1UTW/bRhC961cMBAQhbUoiaYqUnKqH+lwgKHInKGolsaG4wnIVR3FzSWVXbhjE/QLUAkZqIOjBAdraRdFAKNqrEQSB2l+QEM5H06T+C5ldMrKKpkD2sNidmX1vZ/bNhoSDT0PKznsh4ZxAA2q6tVKzDduu16s16xxUKhwDoo7CvKilmDXDcqy6YzuGbldtVRUB8E4J2pSBiKC9DDAuICBa/UGMoK1h5PUCX9koIlRxFUqGaZaNFcOs21WnpjuW7mhQDD2OPssp25ZpmPqKXnOQzK5enbOsdwkjwCn0Q8/HRZdAl3iMS7LYxySQTC/rul59feQKpT3pbhGftoRfubCqrOFyVaSlqoWNAuAQIU06iFoiouuF7ffEZrVFB82QaOAPGCMRz/cqbICSm2AZ5uEqnAHFhKVFS+l0A1fPSa4Lcv4IepdKXr8fDoEhKVavQxRdA8vSwFBFlnzYJ7StBBFXgUagALnMCcI0A44HmkHksaEbd4M2d1nQ6XKZloYn8YTCVHEbU4MP6DpG50aoQFXVYI2GghIDqqDmt8mKK7DfBT235YSSI8PJWYUY/vcClqAwTEfVJMx8yMiM+m1gquabYaTAxOItYeoIA+C8zrPP6IfE59AXFUGMDqFubPokDF1OXR+flHmhK72K8MmVcGVByvwyUi6KUUPBaZnUyygp1EOmRDGWQBH5Lp+mXgLbwslUF7LKgKC+CORxjJJAFbNcFUCi/sunT5EDWYtAZm1xx2nMWYCtKwumFlB9fSZyfp/EsdcRvXD2eLyTjsZPpsnR1l9fHhxPPvt7c/to+8Xk4MnNuydbyVEilsnk4TS5N37x1Siz3kueTb5PP/4WrffHuESQf6bj+8mja7ce7l2b7T0YZ1gnm9sPkuzUy61kNkKspze+forLrZff7D9PJn98Phtnh57v7M1y2sfov/5s5/fjmz+e/Dqe4Q1+eHz97snmp38mZwsLTbMe8K4bcNILoha53DhPY1jreqKVBlEget0Vk3y92G0z2nPzcuTpL7aY/AqwxwrideNBr+ex4AqBtezHQMO/5RWSNqoLyVCftngbQX5GvIUKzSGIXUPOFbAKamHeRzlejkVZrtD/Yr9BzIv/tCbBl2BFtHhNSlywBNElepHkP50iLPhBtQgTOsJTzMcbc1k3UC5i1Ro9r4/fRcBD0iimu7cfHe6kP03Sg9/Sw+8gHd1JRz+noylu0tGNdPRJOrqF1v15CPpAeu6kh7eFIw/Z/SX9Yl/Mu1MELar46b0C6x962WkGAAA=) 2 | 3 | ```kql 4 | let colorPalette = 80438616699584; //tolong(rand(281474976710656)); // <- for random colors 5 | let focus = dynamic({"lon": -122.13129657807407, "lat": 47.642120308747465}); // <- where to place the heart 6 | let scale = 0.0005; // <- zoom 7 | let decode = (T:(Code:long)) 8 | { 9 | let bound = (halfBound:double, current:double) { (current + halfBound) % (2 * halfBound) - halfBound }; 10 | T 11 | | mv-apply r = range(0, 44, 1) to typeof(int) on ( extend bit = binary_shift_right(Code, toint(r)) % 2, Row = toint(r / 5), Col = r % 5 ) 12 | | where bit > 0 13 | | extend shiftRow = binary_and(binary_shift_right(Code, 45), 127), 14 | shiftCol = binary_and(binary_shift_right(Code, 52), 127), 15 | color = binary_and(binary_shift_right(Code, 59), 7) 16 | | project point = geo_s2cell_to_central_point(geo_point_to_s2cell( 17 | bound(180.0, focus.lon + scale * (Col + shiftCol - 64 - 2)), 18 | bound( 90.0, focus.lat - scale/2.5 * (Row + shiftRow - 64 - 4)), 19 | 28)), 20 | tostring(color) 21 | }; 22 | print Message = '䈐℈溌Ȇ锱䘑녉ȉ옱揸Ȍ옱挘ຌʈ아揸ʌ蘮⃠ຌ̈蘮䈐̌႟ࡂСΈ锱䘑Ό아揸톌Є옱獙熌І횪ꌘђЈ႟ࡂꐡЉ옱揸册Ћ萿䏰（Ќ옯勸Ҍ' 23 | | mv-apply with_itemindex=Pos Char = unicode_codepoints_from_string(Message) to typeof(long) on 24 | ( 25 | summarize Code = sum(binary_shift_left(Char, 16 * (Pos % 4))) by Pos = Pos / 4 26 | ) 27 | | extend Code = binary_or(Code, binary_shift_left(binary_shift_right(colorPalette, Pos * 3) % 8, 59)) 28 | | invoke decode() 29 | | render scatterchart with (kind=map, title="❤ᲐⳘⱾⲦ Åℵ℺Ⲧℍℇ℟ KⳘⱾⲦ℺ ℍÅⲤKℇ℟ ❷⓪❷❺❤"); 30 | 31 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-65.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAM1U7W7aMBT9n6e4yp8kEg4wus+qL7KqikxwS8CJPcdpYerDz/a9JmEa1Sa16hwBPvfjnGPnCikstMr0oqrVRsANpCVjDMrSf0pgMAe3ZW7noiFWgntcYO4eVk5LfcmcSnyP7/JJX55eJ/IkxaXe8rWDN7Dh1j1rKXKXtsJ8g96apnuA2cRWDBbJbQJuZTybeaPpLKC1R8zJepzViBiiDeVCaSZCn9sjzX2AsfQhlDIq3WKOSBtEJLhDecZOTHsSxV6JeeptkZd6O6wkpDA3EmmixtYfZCk0Z4ZoUaQngyFlQ+GJZaCDYeUjVSLLEylg7kD3g7kjHWNk+k4OUGYZD+4Lsg+kgmgVVQK6itc3Un2MIc+VfYovLaDPUSagL3QriL4SYuOLW8SQZ0/Bf83T5O460W5MpgOdPIM4WNFtzoe817Kx+RgKJIUr1kbtRG0Zf+JHCGTVwoXbRyYOmp/TWAX2qIW6z+N0PoNUaj/o38dcdeeW+qFtuWl+Cmj5XlSy6S2N/8QD7Ph+67z62a+5zcPJ/7Qob9WgtTB5P6zRT26ElrwWFUGraIOnx7aKG8OPubdQoQW8C//tfm4Xd8XMX3DqQ4sZLIuCXsJL6w09LP9G3hoputfWLtxfnD/+RfkwiBfWxabXMLmcXNCL7t5nhlb/wQyt3nGGVv84Q286K1ejmUs6xS9pHmuwFQgAAA==) 2 | 3 | ```kql 4 | let morse_code = ".--- ..- ... - / .- -. --- - .... . .-. / / -.- ..- ... - --- / .... .- -.-. -.- . .-."; 5 | let morse_alphabet = datatable(letter: string , morse_code: string) 6 | [ 7 | 'a', ".-", 'b', "-...", 'c', "-.-.", 'd', "-..", 'e', ".", 8 | 'f', "..-.", 'g', "--.", 'h', "....", 'i', "..", 'j', ".---", 9 | 'k', "-.-", 'l', ".-..", 'm', "--", 'n', "-.", 'o', "---", 10 | 'p', ".--.", 'q', "--.-", 'r', ".-.", 's', "...", 't', "-", 11 | 'u', "..-", 'v', "...-", 'w', ".--", 'x', "-..-", 'y', "-.--", 12 | 'Z', "--..", '1', ".----", '2', "..---", '3', "...--", '4', "....-", 13 | '5', ".....", '6', "-....", '7', "--...", '8', "---..", '9', "----.", 14 | '0', "-----", " ", "/" 15 | ]; 16 | print morse_code 17 | | extend morse_code = split(morse_code, " ") 18 | | project-away print_0 19 | | mv-expand morse_code to typeof(string) 20 | | lookup morse_alphabet on morse_code 21 | | summarize make_list(letter) 22 | | project jakh = strcat( 23 | strcat(toupper(substring(replace_string(tostring(split(strcat_array(list_letter, " "), " ")[0])," ",""), 0, 1)), 24 | substring(replace_string(tostring(split(strcat_array(list_letter, " "), " ")[0])," ",""), 1, 25 | strlen(replace_string(tostring(split(strcat_array(list_letter, " "), " ")[0])," ","")) - 1)), 26 | " ", 27 | replace_string(tostring(split(strcat_array(list_letter, " "), " ")[1])," ",""), 28 | " ", 29 | strcat(toupper(substring(replace_string(tostring(split(strcat_array(list_letter, " "), " ")[3])," ",""), 0, 1)), 30 | substring(replace_string(tostring(split(strcat_array(list_letter, " "), " ")[3])," ",""), 1, 31 | strlen(replace_string(tostring(split(strcat_array(list_letter, " "), " ")[3])," ","")) - 1)), 32 | " ", 33 | replace_string(tostring(split(strcat_array(list_letter, " "), " ")[4])," ","") 34 | ) 35 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-66.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAJ1VXW/aMBR951dEeSISe9iH9tCpDyt0VaWuIILKtqpCl+QSPBw7unZSQPvxu3ZSWtJ0W0fQlXx8fb98jizRBsWawOBXKILTIAXL31Jiv0ZPjCWhskGQrIFMs4p6t72Af+FQiqLYzdfCFEgmHARh7MznfUk4W5cqRXJr5Xc4AE60UDYuIFujtcLBN87MEHIzA2WpzN16Hw7Cib5H8v4TUCJxcOrM+TZBGWtKkHY+GZu6mrlQqb43c5FlEt3WpfdPMxyvLqSu3S+cGa9WIuFipEXKUBjrwC9+R+GIRIXjCmkl9b3DSmdGuELXz0hU4NZLZ4aaLCgYamUKQZD4DO/DQV3PFDMOTbspZL6cqe9XmBJkbMtU6Bs+jluHamcmYJP1rESTwm4CZH20Hz751dWIIPeJvz2EH5dWar0ZL6WohPYzPvfDBLNZAvE4Mx/WN3fG13YmDzfytm6pGhdmhFaXHvQzjktaQYKxQtz7qquHfHwcTUKI6gykBH8Z6/r2JObIjc40KUh90u/OXGuLBaTXgiqekkPeeRiUjpF4wtc8OOS/Q6XvtlQ4RVMSYWKbprKHAi6VRSlF7E5c5oXUpvE4DXt3n3ryQOUhU29jjticOOgkSHcKcpHUBG4W/dsOHrcp/AJ728TtIG2bry920b1xFw2OSn1G8ha/O6ndxeo2oTu53KZwN3s7ifuUs8+V+X+9dlC+zfYW0dsc/6cujzXw2hvo0kkX1iWb54pp9/cH8bR77RLTq9nnlPVUVb1fQV69wW0BKm3kxkLz8uIt3Fp8iltdvxjNaxKxy09WR7DhGZ4KpZCC/uPz8/fzUaBVs8uhTJnnQGKPwZKBjx/Yl8+wTcAugAh2/Rw2uJB8u33/gEXcaRgFy91jZF969Fh7iolOMeVAddBFDSwOBw65oqMSiCct7cv5m7h1Bb8Bh/HJW3cHAAA=) 2 | 3 | ```kql 4 | let phraseMap = datatable(phrase:string, chars:string) 5 | [ 6 | "ClippyWhispers", "S", "AzureThunder", "n", "SharePointSpaghetti", "V", "TeamsTantrum", "z","PowerPointPanic", "d", "ExcelSorcery", "A", 7 | "WindowsWiggle", "I", "EdgeOfGlory", "G", "OfficePoltergeist", "F", "OneDriveOverflow", "u", "DefenderDiva", "b", "CortanaConspiracy", "3", 8 | "RegistryRage", "R", "VisualStudioVortex", "o", "PatchTuesdayParty", "Z", "DLLDrama", "X", 9 | "OutlookOblivion", "E", "TaskbarTango", "t", "BingBlunder", "1", "DevOpsDetour", "c", "SurfaceSneeze", "v", 10 | "BluescreenBallad", "h", "TelemetryTornado", "Y", "NotepadNirvana", "2", "NanoServerNonsense", "l", "ZuneResurrection", "g", 11 | "IntelliSenseImplosion", "=" 12 | ]; 13 | let phraseChunks = datatable(chunk: dynamic) 14 | [ 15 | dynamic(["ClippyWhispers", "AzureThunder", "SharePointSpaghetti", "TeamsTantrum", "PowerPointPanic", "ExcelSorcery", "IntelliSenseImplosion", "IntelliSenseImplosion"]), 16 | dynamic(["WindowsWiggle", "EdgeOfGlory", "OfficePoltergeist", "OneDriveOverflow", "DefenderDiva", "CortanaConspiracy", "RegistryRage", "VisualStudioVortex", "PatchTuesdayParty", "DLLDrama", "WindowsWiggle", "IntelliSenseImplosion"]), 17 | dynamic(["WindowsWiggle", "OutlookOblivion", "TaskbarTango", "BingBlunder", "DevOpsDetour", "CortanaConspiracy", "RegistryRage", "SurfaceSneeze"]), 18 | dynamic(["WindowsWiggle", "EdgeOfGlory", "BluescreenBallad", "BluescreenBallad", "TelemetryTornado", "NotepadNirvana", "TaskbarTango", "NanoServerNonsense", "l", "DevOpsDetour", "ZuneResurrection", "IntelliSenseImplosion", "IntelliSenseImplosion"]) 19 | ]; 20 | phraseChunks 21 | | mv-expand phrase = chunk 22 | | extend phrase = tostring(phrase) 23 | | join kind=inner (phraseMap | extend phrase = tostring(phrase)) on phrase 24 | | summarize base64str = strcat_array(make_list(chars), "") by tostring(chunk) 25 | | extend decoded = base64_decode_tostring(base64str) 26 | | summarize result = strcat_array(make_list(decoded), "") 27 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-68.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAJVVbW/jNgz+nl9B6MtsQKmbvQBDDxlwuB32ZbgNl9unYQhkm6nVyJIr0U1z2I8fRXttk2aHXYAoikg+fCi+qKrgFySgDqEJnjARxNFh0kABIpoW8AHjEZL1tw7BWY8Qdlm/h4I3TRhjwnLhGOTdBLD9mAG2Y3SwBtURDemmqm4tdWN91YS+6m0TQwo7qu7GREvjA8PF5Z7/hGVnmj3GqnahrnpjffXutw+f3m8+bT/+8ev7zVXfqjeLqoKfsXEmohBPTTR1ndkhEQMN/E1NYKlxLjSGbPBAhjWE5mZW32SVxBxbQ0bExQRwkyhyuBoE5MZ6Khd/LoA/yii90qpW+jutGllbpb/VCuV8p/T3Wt3KSSd7K+d3Sv+o1V7pH/QE4+S4FwAv+yDrICf3vL/WKspRkpVkHfM6ITwI/EHWR4E/yv5ztl389WYxcAhnKeFQB8PZyqkpXiWrXPwNQwx32JyZXf1uqGNh/7DEx8H4FtLgLJ0hZCUNqlIZ58D55NuP0Ry3Dv0tdcUXbJaqLOEnWLEhPhKyg9dqzP3LCCcEL9hzOdNxwLArpuyWuYpy6aNpurmk5wJKYP10fAix/Vc2Y8J0lfOdzHxFb80+XDhgvMCx1IztcxAUeXNJ4yQA2z6ycjT+FotrsV2uNKzKF2FIWT4xmJhnB2M9BVhkUjojZcMc7VtiQT0SZ+apCUC6QGA5xmySGPQu8A3srW/X1nuGPWsZbqfJH6umse9NtJ/xSWk7QWYqfSEtVEJ9FOysj9Eax/pzF9sWeZDUuezsA7ojPA8VLiPLSUiTUxfCniXBQb6gSdQG/w1dwYexr3PaqDP0Uo9ZoM2zBdL9aIR5hN7GGGJ6vrq3nIgOyTbb0whyv6T7SMXpcQnrNdTWF5dkkiN2MoRDkauB0/CcEArz5tzoWq/KUsP/N1hlAyHydY5WX+tImJWvCt3udsV/Xtt6TXFEnUudZy9jjwNP5OK8MK/zXc1kDhfk2fE07M4/WV6elF5v9rh1NlExyaS1uXANzS8Ecrv5BuVVI37O+OfAJf7i2bsw/TZCh8OdJ9kcUPaznTgqUOU/oJC8mEIHAAA=) 2 | 3 | ```kql 4 | // Get the contest rules, to read every single line of them (of course) 5 | let Contest_Rules_url = "https://github.com/microsoft/just-another-kusto-hacker/blob/main/CONTEST_RULES.md"; 6 | // Declare the scrabble letter-per-score allocation table 7 | let ScrabbleScores = datatable(letter:string, score:int) 8 | [ 9 | "a",1,"b",3,"c",3,"d",2,"e",1,"f",4,"g",2,"h",4,"i",1,"j",8,"k",5, 10 | "l",1,"m",3,"n",1,"o",1,"p",3,"q",10,"r",1,"s",1,"t",1,"u",1, 11 | "v",4,"w",4,"x",8,"y",4,"z",10 12 | ]; 13 | print Contest_Rules = parse_url(Contest_Rules_url) 14 | | project Contest_Rules.Path 15 | | mv-expand split(Contest_Rules_Path, "/") 16 | | where array_length(split(Contest_Rules_Path, "-")) > 1 17 | | extend Contest_Rules_Path = split(Contest_Rules_Path, "-") 18 | | mv-expand Contest_Rules_Path to typeof(string) 19 | // Get each of the letters in each word of the Contest Rules Path 20 | | extend word = tolower(Contest_Rules_Path), len = strlen(Contest_Rules_Path) 21 | | mv-expand idx = range(0, len-1, 1) to typeof(int) 22 | | extend letter = substring(word, idx, 1) 23 | // Attribute a Scrabble Score to the words 24 | | join kind=inner ScrabbleScores on letter 25 | | summarize Scrabble_Score = sum(score) by word 26 | | serialize 27 | // Decide (objectively of course) which scores look cool and which don't. Numbers that look cool are either squares or mirrors 28 | | extend Aesthetic_Scrabble_Scores = sqrt(Scrabble_Score) == bin(sqrt(Scrabble_Score), 1) or pow(tolong(substring(tostring(Scrabble_Score),0,1)), tolong(substring(tostring(Scrabble_Score),1,1))) == pow(tolong(substring(tostring(Scrabble_Score),1,1)), tolong(substring(tostring(Scrabble_Score),0,1))) 29 | | extend word = iff(Aesthetic_Scrabble_Scores==true, strcat(toupper(substring(word, 0, 1)), tolower(substring(word, 1))), 30 | word) 31 | | summarize make_list(word) 32 | // Generate the sentence, to try to win the contest 33 | | project Contest_String = array_strcat(list_word, " ") 34 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-67.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEALVUXU/bMBR976+49GWtFEpT6MeYqmkw2GBCm8qkPUwTcpPbNuDEme00ZOLH7147/QhjT9OoRBL7nnPux7GPjuAWEewKAdeYWUOvwkKJGkGq5RJjUBmoQoMtFaiFe53hMqHVy0QiGNRr1KYHtyrFuYorKIWjURCthJSYLREKcwCtIyeVuq05goBZEsfEQJ9GyTXCvKJAEFlMD3RCnwpDu18UpeNgMUYqJk1bLBY9JpyhiCESGheFlJUr42PC8sxixQNV9Wi1gEzZJEJYKA1XWZxEwirKuSXR1sW8e++ppxALS7+5xM4FN+Tq/SkQYwDnusqtOiVxnWTLwOnsvraspzBXSnZbQH/f3f9RAO3REMaDNr3cJFpTEql/UBM55ZL61A4WQhoMHGRMkYM+DPsM+cYDSYyLTJWxEKk0JeTPAnUFUmTLQix9GzEqNL5tUE321U/OYEzvxzA+gdFlO7C6qMNec9g5DLwiwj11HjTmUlDbwj6UiV3BpMEc9hkzgVHImGEfnAyMzvd5w5CDjmF0xkEfNKKlfrlhphX5gRJObAWfc9TC0hwMLHSCWWwOmlqDRhPVmkhAkfGYqGKrZDToepY1svXjzd6Az/7fgLlEKnw85NwulZSqdMNaOSeWCLmmhGPsNUriitwkGHWRGZocV0Ie3RLsWbUBPfb28I2nYV3zsGTygPWp4yM3o7WD/UmccAcv3NhJ7zFXhs8gTUBTj0ry2CsDK5HnmFG9Tb0hp0qOmTD0q2Y1V5+IHlAT7Ji84W6P3rPW+7M4hSLj+6Jx0oLGWFpPlALfOduSYToFTn5HFBKRVSYSUuiOp35qUWvvMbKHD4i5WwugnuqWsv5mwgktbhCiFNVmr7tTGfy7Stj/u8xLnYDnrTBKW74NN5zCRMDLRZoKnfxC8JExpUr2pHbdCa1F1UnpwruTibEd7+UujQvaXYLS4aBDtYerj/adt3en3vCmH/hHyMB0fUieoKu1jrgxS1bNZWJ3IBbhu6zj3PJHmh6zS84qqUjTp95p9x/JVrvQbtefrS7surixac3STJoxuxK3kaaY13F+KYDwxbA6i2tKwi92fwNiLvH3FAcAAA==) 2 | 3 | ```kql 4 | // See the events that were logged on our two of our Region File servers. Somebody wants to challenge us! 5 | // Seems to be a Riddle to solve by us and use our Kusto Powers to decode stuff. 6 | // Read carefully the Hints and take extra notice for Indicators. 7 | let RegionADecode = datatable(EventID: int, Crypto: string, Hint: string, Indicator: bool) 8 | [ 9 | 6, "65 72", "Mirror mirror on the wall",false, 10 | 7, "20 50", "What is the most common query language to secure?",false, 11 | 8, "65 72", "4B 75 73 74 6F",true, 12 | 9, "6C 20", "We just replace 10 with 8",false, 13 | 10, "68 61", "50 65 72 6C",true, 14 | 11, "63 6B", "Greetings to my Security Operations friends!",false, 15 | 12, "65 72", "Moving over to your next Region",false 16 | ]; 17 | let RegionBDecode = datatable(EventID: int, Crypto: string, Hint: string, Indicator: bool) 18 | [ 19 | 1, "72 75", "Follow the hints we provide.",false, 20 | 2, "73 74", "Ensure you follow the Indicators.",false, 21 | 3, "20 61", "We Just like to change Rust!",true, 22 | 4, "6E 6F", "Expose a Secret what's happening.",false, 23 | 5, "74 68", "Trust the hacker's 3th event.",false 24 | ]; 25 | let Hints = union RegionADecode,RegionBDecode 26 | | where Indicator == true; 27 | let Hint1 = toscalar( Hints| 28 | project-keep Hint, EventID 29 | | where EventID == 8 30 | | project-away EventID); 31 | let Hint2 = toscalar( Hints| 32 | project-keep Hint, EventID 33 | | where EventID == 10 34 | | project-away EventID); 35 | union RegionADecode, RegionBDecode 36 | | sort by EventID asc 37 | | summarize Decoded = strcat_array(make_list(Crypto), " ") 38 | | extend Decoded = replace_string(Decoded, Hint2, Hint1) 39 | | mv-apply DecodedMsg = split(Decoded, " ") on ( 40 | summarize DecodedMsg = make_list(tolong(strcat("0x", DecodedMsg))) 41 | ) 42 | | project Secret = make_string(DecodedMsg) 43 | | extend Secret = substring(Secret, 1) 44 | | extend Secret = strcat("J", Secret) 45 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-4.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA81UTY%2FTMBC951cMvdiRIpmkXWC7ioQ4wAEhrQS3tlp5U9OmTePIH9LClv9OHMf5zoI4MT24sTPvvXkzccYUAIUYMDRRcLlOc%2BU%2Fm4c9VeXvMWPuFEPGlGIC1k2CVCLND%2F4GUbS7sifF8r07uucyLvF%2BwZ1Jg6RiaghG4Abfwq8dKPSCkG9Hmp8lIR4ASoZ8ju7OPhpK1i3OMcNzvTEur1NdLQE2iLVEDYUBP7bgLXSL6WppxH%2FWUnFSiW%2FR7SE6DooZ1GKrOYFj7HWpiSlHh2UNouneaabIc4yt84xe4CMX3tDHCdIRn2UBVy46j0ZlPkZOtGH05f3xddE1iJAPOs32pQKvp3fQoL4jrjOA8tm5tmPNpxWMZAxirlkmOgYS8lUnR6DjsUF87OLk2IgXBP6jwol7wEVXIiGfBKPKzjwSf5hxo1XOf7CT98WsjmEb20ByZtRVjHtu9KeloexNzfCiQuovbiU905AXegE9B2avSULuBd%2FrRL0yhuuJz2zS9IImrC2%2BT%2Fo8Yp0WN2944w1MGN85J014hMyi%2FPfh6TzlOdY4vPH9AOf4rVlOODSLxpFZJA7fmFXhVfVoGoDDpd0KqwSBoyq%2F3K8yzzhc2TVa2v1oZd8Low7Grfmf4KjaO%2BLwtVkpjioMjsN3ln7ZptzYk%2BqAerjWdWvzozLf9cy2P07T77hsH6Q54DAoRQWK66Jgop4PP6jXKxf78tN8%2FGG6DVQmV6kvFyrSn6zGkvGFntlDlkrlkq%2BF4CeWKPjCpKQHFgtWZKXMB8EO7Akrbuesfl36wXu02W62i22w3e1QsFj4vwF9Mzqe1ggAAA%3D%3D) 2 | 3 | ```kql 4 | let a = ( pos:int){ datatable ( letter : string)['a']|extend Pos=pos} ; let c = ( pos:int){datatable (letter:string)[ //Thanks// 5 | 'c']|extend Pos=pos}; let e = ( pos:int) { datatable (letter : string) ['e']|extend Pos=pos};let h = ( pos:int) {datatable (letter: //Kusto/// 6 | string) [ 'h']|extend Pos=pos}; let j = ( pos:int){ datatable (letter : string)['j']|extend Pos=pos};let k=( //Team For 7 | pos:int) { datatable (letter : string ) [ 'k']|extend Pos=pos}; let n = ( pos:int){ //Building 8 | datatable (letter: string) [ 'n']|extend Pos=pos}; let o = ( pos:int){ datatable (letter : //Such a// 9 | string) [ 'o']|extend Pos=pos}; let r = ( pos:int){ datatable ( letter : string) [ //Great/// 10 | 'r']|extend Pos=pos}; let s = ( pos:int) { datatable ( letter : string) [ 's']|extend Pos=pos};let t=(pos:int){ 11 | datatable (letter: string)[ 't']|extend Pos=pos}; let u = ( pos:int){ datatable(letter:string)[ //Product! 12 | 'u']|extend Pos=pos}; let space=(pos:int) {datatable(letter: string) [ ' ']|extend Pos=pos}; ////////// 13 | // 14 | union(u(15)),(n(7)),(j(1)),(u(2)),(s(16)),(t(4)),(space(13)),(t(17)),(r(25)),(e(11)),(k(14)),(k(23)),(e(24)),(r(12)),(space(19)),(c(22)),(h(10)),(a(21)),(o(18)),(s(3)),(space(5)),(o(8)),(a 15 | (6)),(t(9)),(h(20))|extend letter=iif(Pos in (1,14),toupper(letter),letter)|order by Pos asc|summarize letters=make_list(letter)|project Message=replace_regex(tostring(letters),@'[\[\"\,\]]',"") 16 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-71.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAG2WzUsjQRDF7/4VQ04KQau/5mPBg0ggGDCg8bTsIZqgAY2QzbIK+8dv19SrmZ6eJJffq+5+XZPX07pZH+P3+X17/vWj2Hz+iTQtvnt8WR+3r5+HWPl9POz2rxc/z4r4uboq7p4eVy2bS5ra6eTOTKZ2jFbQDNEJkqAB+r7q+2oQNILtlk7Mn+I+ToZStII0xLiPH6MXNEMMglaw3TKIfoz7lD1q1QqaITqZm6EXJMEADH1Vt6zEfGXWk2mdcHUZWrZgk7EDE1gTu7lfruazBwmNxPAmPkTLJmMLpoS5znGZjHmOT+opB7AF675lUi/Ro8GhuedGcBIGzI0g+wE7MAmLGRJcsgHiHjAbhBPswDZjj7Vg2aTUXJ7jaJWKUlNSYXLhVBCEWCLqOfdaS08dx2Vz7rXJmOc7MAm3ZhY/94zfSJOw1i2YEo7GM4f5yjrHow6WTRDbAxsjqo65zsbuBDuwydhjbc4Bc0hYz/Ui3kRL6QRZLXgV8uw4OizYAZG1rPUSdRIWs0pvGX6WSu+ZgbAQNBL8PPVJ4SHMSAQICyFtNHrd8BVHiehHLIQZCYc1Y+EhCMI2KkI60l25OD0rXmcTNjjnAWwyLsEkLGY4AcsmDiLRARuKwp8UBsKOhIWBCj0f85vbBa49h/Dn3DkC75hfKO68ypjnl2ASFrNa71BuA/n2or1RuacmF+00B2FVdG4+HdGXzCP522jvTcJat2DK2GE+WMwQ4KKKg3hjO+b3oY6Mn7JlrTeok7CYIYAZ/9UMCWu9BFPCfK9UmK+sc2rUwbIJgntgAwTXMdfZoDrBNdhk3GBtznzYfKWXGE3Ofp39Kw7b/WZ7KN53++3L2/pwLP7ujm/F+ffHbn9N8f+lj/XXtb34D+VQE2ZMCQAA) 2 | 3 | ```kql 4 | datatable(x: double, y: double, category: string)[ 5 | // JUST 6 | 1.0,2,"J1",2.0,2,"J1",2.0,2,"J2",2.0,1,"J2",2.0,1,"J3",2.0,0,"J3",1.0,0,"J4",2.0,0,"J4",1.0,0,"J5",1.0,1,"J5", 7 | 3.0,2,"U1",3.0,1,"U1",3.0,1,"U2",3.0,0,"U2",3.0,0,"U3",4.0,0,"U3",4.0,0,"U4",4.0,1,"U4",4.0,1,"U5",4.0,2,"U5", 8 | 5.0,2,"S1",6.0,2,"S1",5.0,2,"S2",5.0,1,"S2",5.0,1,"S3",6.0,1,"S3",6.0,1,"S4",6.0,0,"S4",5.0,0,"S5",6.0,0,"S5", 9 | 7.0,2,"T1a",8.0,2,"T1a",7.5,2,"T2a",7.5,1,"T2a",7.5,1,"T3a",7.5,0,"T3a", 10 | // ANOTHER 11 | 10.0,2,"A1",10.0,1,"A1",10.0,1,"A2",10.0,0,"A2",10.0,1,"A3",11.0,1,"A3",11.0,0,"A4",11.0,1,"A4",11.0,1,"A5",11.0,2,"A5",10.0,2,"A6",11.0,2,"A6", 12 | 12.0,2,"N1",12.0,0,"N1",12.0,0,"N2",13.0,2,"N2",13.0,2,"N3",13.0,0,"N3", 13 | 14.0,2,"O1",14.0,0,"O1",14.0,0,"O2",15.0,0,"O2",15.0,0,"O3",15.0,2,"O3",15.0,2,"O4",14.0,2,"O4", 14 | 16.0,2,"T1b",17.0,2,"T1b",16.5,2,"T2b",16.5,1,"T2b",16.5,1,"T3b",16.5,0,"T3b", 15 | 18.0,2,"H1",18.0,0,"H1",18.0,1,"H2",19.0,1,"H2",19.0,2,"H3",19.0,0,"H3", 16 | 20.0,2,"E1",21.0,2,"E1",20.0,2,"E2",20.0,0,"E2",20.0,1,"E3",21.0,1,"E3",20.0,0,"E4",21.0,0,"E4", 17 | 22.0,2,"R1",22.0,0,"R1",22.0,2,"R2",23.0,2,"R2",23.0,2,"R3",23.0,1,"R3",23.0,1,"R4",22.0,1,"R4",22.0,1,"R5",23.0,0,"R5", 18 | // KUSTO 19 | 25.0,2,"K4",25.0,0,"K4",25.0,1,"K5",26.0,2,"K5",25.0,1,"K6",26.0,0,"K6", 20 | 27.0,2,"U11",27.0,1,"U11",27.0,1,"U12",27.0,0,"U12",27.0,0,"U13",28.0,0,"U13",28.0,0,"U14",28.0,1,"U14",28.0,1,"U15",28.0,2,"U15", 21 | 29.0,2,"S11",30.0,2,"S11",29.0,2,"S12",29.0,1,"S12",29.0,1,"S13",30.0,1,"S13",30.0,1,"S14",30.0,0,"S14",29.0,0,"S15",30.0,0,"S15", 22 | 31.0,2,"T4",32.0,2,"T4",31.5,2,"T5",31.5,1,"T5",31.5,1,"T6",31.5,0,"T6", 23 | 33.0,2,"O9",33.0,0,"O9",33.0,0,"O10",34.0,0,"O10",34.0,0,"O11",34.0,2,"O11",34.0,2,"O12",33.0,2,"O12", 24 | // HACKER 25 | 36.0,2,"H4",36.0,0,"H4",36.0,1,"H5",37.0,1,"H5",37.0,2,"H6",37.0,0,"H6", 26 | 38.0,2,"A11",38.0,0,"A11",38.0,1,"A12",39.0,1,"A12",39.0,0,"A13",39.0,2,"A13",38.0,2,"A14",39.0,2,"A14", 27 | 40.0,2,"C1",41.0,2,"C1",40.0,2,"C2",40.0,0,"C2",40.0,0,"C3",41.0,0,"C3", 28 | 42.0,2,"K7",42.0,0,"K7",42.0,1,"K8",43.0,2,"K8",42.0,1,"K9",43.0,0,"K9", 29 | 44.0,2,"E5",45.0,2,"E5",44.0,2,"E6",44.0,0,"E6",44.0,1,"E7",45.0,1,"E7",44.0,0,"E8",45.0,0,"E8", 30 | 46.0,2,"R6",46.0,0,"R6",46.0,2,"R7",47.0,2,"R7",47.0,2,"R8",47.0,1,"R8",47.0,1,"R9",46.0,1,"R9",46.0,1,"R10",47.0,0,"R10" 31 | ] 32 | | render linechart with (ymin=0, ymax=2) 33 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-69.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAI1V23LTMBB9tr9i32J3nKYppe3QyUsLD9xmGAr0AZhUtuVGVLY8kkIbCK98AJ/Il7C6JW7itngyjmPtrs5ZnbMZjeBixjSF85YUeNeSNVfAGi3g9VxpEXOqXYQyAS+aQi5aDRNIWk5Y80zZhDT+GQNeoxGMd0ORv7//AJGSLEBU8LFhhSgpmNuwFbiBshkthmooWoUl5y5mam4uZFpJUU/dHm7D1GYtof4+pLctaUrMxVRTwK/QW03t65eNwalNoaRoU3jsQvAFURpEg42ohISc6aFoVWC2vwsXhF+DnlE4NosKkrfnp0jzzflpmiEVUc4L38nRB5KvoZK25QtQM1YZSOWiITUrks9H2WH2NDvInmT72Tjb+5ri3pDEAZBngjt9IhzzctYQuZgi6eQRHpKS0uLE3Lg3yNeykKaSXc1Mj7BjmW+YXUiR1ThdFVh2EJ3NJCJiVZUEeBMYZzD4ogd4h0Gn3YhnR9FCNOVOKDBXVHlenepqXtdEsh/UNXcCePAF0VMrovsom1MTnNNC46GoRZ0Lrvop1+SaTjlTOnH4kdxgENgFXSkqGeEGQzj2J7vwClsC+QI9kAEpS2joDWcNhZJyVqM1ZEheEUCfoIjLTQ5xHxoXYUAp08BmkHaQLY2svhl2vmT862TDk8/pypMFa2dU9pryFDVxDS7A+ft46NoFhkvXjfa3gd5ypn1Nj2zLfbYPk06JJdxgODW8OW0Ss5AacRx3bPSeDolStM45dSrF1oKx+v3eaYXqOmcP/bKPvjlA/xxmR485x+hUzXM/SAymoHOse1fkfRfCd8JGhe/1+AG1jZXztUWdrTitdI9ssQduEthTwKlW0Ad3dywyOIJhB3QKvc4JYw/fJB7WvRLvKPxsPZbt3C5mRJICle1+VkiLg2vfltbfmbn8X0rvGfBahPF+l3R/R1Ad136DMNeRbpp6xwBseMZCC465MY5xf3MTuLy8hAjwE2FOFJnvyD3gLbwx5SIPJ7IPdsmuhodusPv2wZ2Cd+rYlejBTVeVu7tHWzBC1qrgxqbI8STemhPJug/pP7xmIhH+BwAA) 2 | 3 | ```kql 4 | // White Space String into Kusto 5 | let WhitespaceEncrypt = (plain:string) 6 | { 7 | // 1. String → array of Unicode code-points 8 | print cps = unicode_codepoints_from_string(plain) 9 | | mv-expand cp = cps 10 | | extend cpInt = toint(cp) // cast once for bit-ops 11 | // 2. Walk the 8 bits (MSB→LSB), produce Space/Tab 12 | | mv-apply shift = dynamic([7,6,5,4,3,2,1,0]) on ( 13 | extend bitVal = binary_and( // read the bit 14 | binary_shift_right(cpInt, toint(shift)), 1) 15 | | extend bitChr = iff(bitVal == 1, '\t', ' ') // *second* extend uses bitVal 16 | | summarize bits = strcat_array( // collect 8 symbols 17 | make_list(bitChr), '') 18 | ) 19 | | serialize 20 | // 3. Join bytes, add newline delimiter 21 | | summarize Encoded = strcat_array( 22 | make_list(strcat(bits, '\n')), '') 23 | | project Encoded 24 | }; 25 | let WhitespaceDecrypt = (cipher:string) 26 | { 27 | // 1. Break cipher into 8-symbol lines 28 | print lines = split(cipher, '\n') 29 | | mv-expand line = lines 30 | | where strlen(line) == 8 31 | // 2. Re-assemble the byte from Space/Tab 32 | | mv-apply pos = dynamic([0,1,2,3,4,5,6,7]) on ( 33 | extend bitVal = iff(substring(line, toint(pos), 1) 34 | == '\t', 1, 0) 35 | | extend contrib = binary_shift_left( // shift into place 36 | bitVal, 7 - toint(pos)) 37 | | summarize cpInt = sum(contrib) 38 | ) 39 | | serialize 40 | // 3. Code-points → characters → final string 41 | | summarize Plain = strcat_array( 42 | make_list(unicode_codepoints_to_string( 43 | pack_array(toint(cpInt)))), '') 44 | | project Plain 45 | }; 46 | let whiteSpace = ``` 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | ```; 72 | WhitespaceDecrypt(whiteSpace) 73 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-73.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAH1V207jSBB95ytq/WJba0BcBo2CInELLFp2iEJYHkZs1LErcS92t7e7neAI8e1T1TaQoJnlJaRTferUqVPVu7vQ78M4R3hAsUATWrjRuuzBtXJo3FIqqeZwO53VNhUOMwo1KDJLt7Z2d+EGHTi6bMQygZkR8xIVR9WObguVooUpwlxQjKHjmdGlj0c+2NnZ2SoIYCSWD7m0FRqCheCyg3kdpLneexmKptAi64+bCntnR4evF8KJ3p36e5Wd9vvHsBG+vxk+Hp1+u2svrFRxYhfmU/zBr+APCP7q62f4w1/C21X6tDDBMYvCaj5hA05DrQqdPvmSHelhC6/h8q3ayNRKpiAVKW+lVjZmTQji/HY0GpyPr2+/welweHM9uIA/BqNBD/4SLs0JIhSaQEPOEa64shBSbQymrmhaUWuFf2IzuctFppesqw8LjoHgr4qmyi3lZWbSgJ7atPYN0qaEaJVAkcBJAjaBRbwBdyPnuWM0n79FG3sMZ2rqq7VIXQeDCxQFAUYiAZ2ASyBPAGOubWiwEga9KAV5jdKgc2wzLxMqVoJ1qIxU3h1UNBopiv6aUxjpzmEFe+RVq1lYQJHmb+J6t7WtA6EykM4CUdMZJ6oE+1NtvQA+U8IMLnWtsmF7yiakYyNSNxFFEZ0Eke92RO548S2P49fIdz36/s/x4+9xHCTrNON3bvs9uFeG5qrwtVVvCbSivkmVyYXMasE/+qFKyDZYMUGL/9UsJDEsF9v4XHEJS+nyiXRY0k187t91Mdf8DTpdmBbx36yHkjmqQM+irFGilOkHw4MeXEibUphnqIQjH3jBUiLJ4ulZq2vL8UOyQScma0MZnZFlFEJIvdaFXqKJnLZ0qObRGrXve49xHLNpwunRYQjaQOgHI4RtT6AUcxoIZvspE2bnHaH1XLaedkl+mm3/MU7gS5tw/LamsIWDjKVqLyVk2FIvWPnANzaAyuBMPr/rdNiD06oqGk9SVJXR5E72nGfPYyMc2RaMdL6huhuBbvRpNJbarKk36gbkgU6polRYjLaA/jZlpUEjncheUwo4OpxkyNwn78VuSkPFEt9RS4H6duYvkQUXKAsK/3kCXwGleF9Q0ebuSDaHP4H/TzryK23cgbEm0b1lZbv9RMrTcrSxJxNsb2/zrrsfjgcX9H/AWMNCpJjrIkPDCwlmQvIqaaW1dO/Dvl967bvVPkJvS4elpodH0Ob9WHFGzqViioZwqRH+E6YNbM6RsOk7+lEPrvzT5eFn/vpSL1BBlRvSllBsXZbCyBW9nwQ4FhVSZxrqaCmecFJI66L1Vnvmlx6IM/R4GVo2NSdIdVnRrm0LeCJwctm/pBiblB7fiTBGNNF6ngQCCLy7z7xg7ZYxRNFMf/sBPve5DNsHAAA=) 2 | 3 | ```kql 4 | // == The Weaver's Loom: Intertwining Obfuscated Threads == 5 | // Let the raw, fragmented utterances be gathered from the ether... 6 | let RawWhispers = "Fragment~Echo1|Payload=Type:B64~Data:SnVzdA==; Fragment~Echo2|Payload=Type:TRANS~Data:znl@svr; Fragment~Echo3|Payload=Type:B64~Data:S3VzdG8=; Fragment~Echo4|Payload=Type:TRANS~Data:szckvr"; 7 | // The key to unlock the translated whispers (runic inversions)... 8 | // CORRECTION APPLIED HERE: Matched 'aothe' to 'zl@sv' correctly 9 | let RuneKey_Shadow = "zl@sv"; // Glyphs in their obscured form (z, l, @, s, v) 10 | let RuneKey_Light = "aothe"; // Their true essence revealed (a, o, t, h, e) 11 | // Prepare the loom, setting the tension... 12 | print RawMaterial=RawWhispers 13 | // Step 1: Isolate each whispered fragment and its encoding pattern 14 | | extend FoundPatterns = extract_all(@"(Type:(B64|TRANS))~(Data:([^;]+))", RawMaterial) 15 | // Step 2: Unravel the patterns onto individual threads, keeping sequence 16 | | mv-expand with_itemindex=SequenceIndex WhisperData = FoundPatterns to typeof(dynamic) 17 | // Step 3: Discern the nature and content of each thread 18 | | extend EncodingType = trim(' ', tolower(tostring(WhisperData[1]))) // 'b64' or 'trans' - the magic type 19 | | extend EncodedContent = trim(' ', substring(tostring(WhisperData[2]), 5)) // The raw, encoded data string, removing "Data:" prefix 20 | // Step 4: Apply the appropriate transformation ritual to reveal the true word 21 | | extend RevealedWord = case( 22 | EncodingType == "b64", base64_decode_tostring(EncodedContent), // Ritual of Base64 Unveiling 23 | EncodingType == "trans", translate(RuneKey_Shadow, RuneKey_Light, EncodedContent), // Ritual of Runic Translation (Using corrected keys) 24 | "---CORRUPTED---" // Placeholder for failed rituals 25 | ) 26 | // Step 5: Weave the revealed words back in their original order 27 | | order by SequenceIndex asc 28 | // Step 6: Gather the final woven phrase 29 | | summarize WordTapestry = make_list(RevealedWord) 30 | // Final Step: Present the completed work 31 | | project strcat_array(WordTapestry, " ") // Behold the proverb! 32 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-72.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAG1VzW7cNhC+71NM92QDcpz2Vhc5uEkLtzHSpHXQQ1EElDhaMUuRCn9W3qAHP0QveYE+WJ6k34zk2gEKA+tdiZz5+P0Mz8+HUqZ8cX5u9ubJmM/fm/2w8VxoMN2e0+8x2UzPaGNNwV/r+UQeXeSSXNidbv7YbH+uuZDJVAamzvQ9u8C0d9htyYWGLj3fUmLj3Uc8waLBWDJd5yyHYrw/kmU0xDupMKcYdiTdWpP5ybbZbN8Gy4lCpM6lro65mNBxpi5Wr/WMHV3BZgcMkeRfG3PWrb9FWWCdpXkwQBmOlPfOewGi56NZq9j4+e5vrGy9GfFuux2PuXBysWbK8nWknXelGxh1t1L5hrshuE7wNwrcx13WTi5YPC/AFcjlXLmR9dRWwQgQM7hquTM1839s+ByxNwu/SsOo6C+9p9gvJ1tPaw4AyRzIHCIIRLd+LRI+330qBHKOeFon1PQU3G4o1EIpPpsN4OMb5c6d9Y7GeHC8sPQqzqtMAuabpzS6UAsrnYlziYmJD5yORQu03MsTQTWaYHZgEcSsemvBXwJUNVRSZXoJe0Sa3UeT7HqKqQKbnir2PfZQceMi9Q2HzA3lmU1BqwYcWhprES3QOeFnHOnlm2vqa+iKiyFTVXuo7HBZGRohxBu8HxQRuhtdqh2usG7PxzYqHG8UNtjvTS4NwUc5SkFL3u0XCUMRUPd+UdrwCevuFsw/PDAj0u6ifNsJFHiqhuK8mvSx4ctxQgeb4kSaKXqdoq0K8sX3WvRXzYvWFM+sPrExrG6SIyKkUU0leJBBm8wI2jramTypYFCvQ1qVBuHadSobBD1ql5chztIDJSCooI+iHLqABl8Fj7L5oSLOeJEY8Sxf1nibpYKxB0mlROd1Qpgh241I8kphXJlp4sB2u6WiuflQOWvlTnjCNgMBwHfiKaayRnfkQYyJ4AugEHE0tp/v/iG+7Xgq9ELC0CcY4qebBjxFPYHxKGmR85on10mCF2eZveKk7CYJlYD7tgxwJCYWr/af0N8kwIHBdYXKyMItS0vwQUcuDx4X464jpLD3Ks2SyP9x+uK/WFOGPeHo5osIzcYvCVLPZzOrsHmMsQxnqYag2dVZtAyH0WCeKolTMi5jr55BoPfudpWVHg2yZYLp5ueYuG3SjKnBU1gGmVYI0T4EAMmF+TMgws3z4GDWyZsFTVBxka8SazcAxr2JyezMOgqW+It5M+TCBHNjo7Mw8G1R/kTRAZ+frFRokYcjvV/ulL1qfJ+ysGYwYy8qtfiBOZfhEymT19yMPLbC7d7ZfAE76vV0CffA4+swutIyMOMe/s8El8khck0Hd+Cv6IzaIz2Pk/OxiO1o5O3mz+82j27EzV8wobr8R5dyuWaZULgmc22Xm1FvyYaeNvT1KWF1ruNoEm5AukZ26BlW4Y54Z1IyRzoZ4f13Hi9OHpU7bYD+9F9uwaIGoQcAAA==) 2 | 3 | ```kql 4 | //https://aka.ms/jakh 5 | let hackerWords = 6 | datatable(Word:string) 7 | [ 8 | "Just as the caffeine kicked in, Alex realized he had accidentally deleted the wrong database.", 9 | "Under no circumstances could he admit this to his boss.", 10 | "So he did what any skilled hacker would do—he blamed ""mysterious system glitches.""", 11 | "Technically, the logs did indicate an issue,", 12 | " but that was because he had also disabled them.", 13 | "All of this could have been avoided if he hadn’t stayed up all night binge-watching sci-fi movies.", 14 | "Now, Alex had 20 minutes to restore everything before his manager checked in.", 15 | "Only a true Kusto wizard could pull this off in time.", 16 | "Tense, sweating, and muttering random KQL functions under his breath, he launched into action.", 17 | "His keyboard clacked so fast, it sounded like an intense hacker movie montage.", 18 | "Everything was going great—until he accidentally typed drop table ProductionDB.", 19 | "Realizing what he had done,", 20 | " he let out the most dramatic gasp ever recorded in office history.", 21 | "Knowing there was only one solution, he quickly rewrote history.", 22 | "Using advanced ""Pretend This Never Happened"" techniques, he created a fake report.", 23 | "Somehow, no one noticed… except Dave from IT, who was already suspicious.", 24 | "Taking a sip of his 9th coffee, Alex prepared for his greatest deception yet.", 25 | "Only time would tell", 26 | " if he could pull this off.", 27 | "Hours later, his manager walked in and saw the smooth-running system.", 28 | "Amazed, he praised Alex for fixing the mysterious glitch.", 29 | "Celebrating internally, Alex nodded like a wise sage—while planning never to touch production again.", 30 | "Kusto had saved him, but next time… he’d probably just ask Dave.", 31 | "Even hackers need backup sometimes.", 32 | "Remember, kids: ""Just Another Kusto Hacker"" knows how to survive! - by Copilot not me" 33 | ]; 34 | hackerWords 35 | | extend FirstLetter = substring(Word, 0, 1) 36 | | summarize List =strcat_array (make_list(FirstLetter), "") 37 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-70.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAH1VTY/bNhC9+1cQOkmFC68/sm0d+JCmu62TBlmsF2naIBBocdZiViIdktqu0/RSoNcAufWW/9Bflp/Q4YcsSklqw7BJPc6892Y4nkzI5ursgkxHFRhyruiuBmE0WRFGDb63FaS/SMXWbMmFGZMzUUgGbKmN4mKXjV6MCL6mY5JsxLM37MFqlYxJ+5pMSPKo0SZxoBmC1j+eN9v5pfzt+boFWhChQpoSlAfOLfDMTIv55e0gGnmM4aSHLVy8svx1Zqpih4kjWEmLGxvu5f3RJCicOYU/gOWvHkpxzXc9lX6r1elXS3YQtOZFpDPspH8kPtQTMKVkyTLZUg2nC+SbPKMVx7jwsKRKg0mWRjWA+5fwuuEK2DmHiulk+SLxztozwdfk5Z9ZTHruSJ8Jo+T+sBb7ZlCaDQBbCwZ3nrVdYvYGPlMfv5ODj5VrhObTZHwszeuGCtPUfcAsAGxJbvlWUcOl6EPmAWLLsSulNv3HCyzC6C2BOwOCtUp+orpEHSV+5bqks3un6ZF61qG9PQg8yuycWThnHkku0NCobY+/Ham35BUiyA0XbMWFADXwUoqQJKD3Sr6CwoTNY7uPY+IBiggMtz20LKkuRh29e1G3MYuw3AZsQ6AgNmAR5jspZ24jN9JXLg1csv6x0GRr/UAXnONpfn2dck3tKg0xszHxLXhNKw1tgN/xwsHg/BdsCHEifadO36aQqpMXq+2TfPKzQyJGUcHSjHxFpicn/59s3J6Ksn7jsl5iDFnzN86siEI/p0d9z6k+ph1WLoL0q/ety3Mlb0Bc8D1UWDYM0uXtZ3K4Tv9Alnsa9nRT11RhBGu71BtXWDyJFS6oyalS9JDW9AbyimuTuqNYvIQkWcTuO8fu6R78ddzgMGgGY8HAPkwE9/Az46CS1M6b7v77dmPxhQ9zjEU3nGoNNaZgvWt9RTsVaWJJ5jjUjp1r6WT2XvuWs0uyWpFFJ2l64v9/uKDV08bg3cR4Pf/7lrctp/cVN2lkZjDLg+vbr+FuT1v8J0Vw6S5Khffty0VwR7Ne3J5qLxfHXKRmSj5+ePdv+8HF+7+JagSpARuN1FQciOE12LYjB9kQgfMN7SI79AD/B4n3jeDksivFd6UJXfvxwz9/9YKPBn0w+nTkxa7iwEPao649j25jyjpFkePYluw/DA+oEiAIAAA=) 2 | 3 | ```kql 4 | // STEP 1 5 | let Fragments = datatable(WordId:int, Encoded:string) 6 | [ 7 | 1, "SnVzdA==", // "Just" 8 | 2, "IGFub3RoZXI=", // " another" 9 | 3, "IEt1c3Rv", // " Kusto" 10 | 4, "IGhhY2tlcg==" // " hacker" 11 | ]; 12 | // STEP 2 13 | let DecoderConfig = datatable(ConfigId:int, Config:dynamic) 14 | [ 15 | 1, dynamic({"DecodeMethod":"base64", "ValidateCharset":true, "RequiredFields":["WordId", "Encoded"]}) 16 | ]; 17 | // STEP 3 18 | let EntropyInputs = datatable(SeedIndex:int, SeedValue:string) 19 | [ 20 | 1, "string_entropy_seed_1", 21 | 2, "quantum_entropy_seed_2", 22 | 3, "vibration_entropy_seed_3", 23 | 4, "ghost_entropy_seed_4" 24 | ] 25 | | extend EntropyHash = hash_sha256(SeedValue) 26 | | extend WordId = SeedIndex; 27 | // STEP 4 28 | let JoinedFragments = Fragments 29 | | join kind=inner EntropyInputs on WordId 30 | | project WordId, Encoded, EntropyHash 31 | | order by WordId asc 32 | ; 33 | // STEP 5 34 | let DecodedWords = JoinedFragments 35 | | extend Decoded = base64_decode_tostring(Encoded) 36 | | extend CharsetIsAscii = iff(isascii(Decoded), true, false) 37 | | where CharsetIsAscii 38 | | project WordId, Decoded 39 | ; 40 | // STEP 6 41 | let ScoredWords = DecodedWords 42 | | extend MLScore = rand() * 100 43 | | project WordId, Decoded, MLScore 44 | ; 45 | // STEP 7 46 | let Randomized = ScoredWords 47 | | extend RandomBias = rand() 48 | | order by RandomBias asc 49 | ; 50 | // STEP 8 51 | let TokenPipeline = Randomized 52 | | extend Token = Decoded 53 | | project Token 54 | | summarize ChaosString = strcat_array(make_list(Token), " ") 55 | ; 56 | // STEP 9 57 | let OperationStatus = datatable(Step:int, Status:string) 58 | [ 59 | 1, "loaded", 60 | 2, "decoded", 61 | 3, "validated", 62 | 4, "assembled" 63 | ] 64 | | extend Tag = strcat("STEP_", tostring(Step)) 65 | | where Step == 4; 66 | // STEP 10 67 | let FinalOutput = TokenPipeline 68 | | extend Words = split(ChaosString, " ") 69 | | mv-expand Words 70 | | summarize FinalPhrase = strcat_array(make_list(Words), " ") 71 | | extend Tag = "STEP_4" 72 | ; 73 | // STEP 11 🎲🎲🎲 👅 run me as many times as you need to get the string in the right order 😂 🎲🎲🎲 74 | OperationStatus 75 | | join kind=inner FinalOutput on Tag 76 | | project Output = trim(" ", FinalPhrase) 77 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-74.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAHVVa28aRxT9zq+4QlUNEo4BFz/S9gMmhGLHsSWUJlVVRcPuABOGme3MrA1Rf3zPnV2zu5ayfGF2z7mPcx9zdkb3KnHW21U48TTqnx6kcPTN5s7IA+1ElsmUgqX2be4DCWPDRjq6w8HSRiRb6dqtszO6Y7DSEq+N9KRMw+xG4b070LMKG0qsc9Jn1qTKrEnLEKTzrRb+1C38TqkI+C217PyFkN4qE3owWgLe+uBA79GHyC+P3dbfLcIzuL4c9ah9DIFWNjcpElke6EZpTTMR4EOYlB5FrmmstTRtMG7bvdLAVR/H98ohaXiWzoigrBGa7GqlEskZ3opMRFZesQbsdnH67mFBgzd90iI3yQaOY+bzm3t6nDDDV4zzRqCfrUvJSS2FB2tlHRXWmBQqEmf3WZnUPvvoZ/ZpfvTFUDpCrzmPhyJmn6sgKZXLPHjqsKseTfeJ1F3miIpTN389oiVr62kRhEONpMkZbir4JY5/Kp9DnUXIU2VZMmfTPClzSOWTZ44tOcN+f1Bz8eURKadypbjwqfTbYDNq5gwGB/Vlafd0ftGn3DxJ9EJhfi12CJDhmwp+heP4e+4kJdrmKWVaBIB3qLpBNySFUPJIGNSEOr8YlaxCsgbFVRROYrE9ZEAk/+bKlfH8dPVmdFMvA6BDhuZuJWA+dnUgjXxrSjHhriL8wgQRDoI+ilRqLciIHRxMpg/1ngOy0Qy1nhOeVk5KyrO1g4l634F1geMHZbYynZtX4Q8vbpraD1jMmQp/5MtX0Msy06qyg+uj8GOXkNxjSFKsgAO6KC1UbUoz7DcmIENV1+iDRLilNWTkGpP3pMKhWd9hvYEGg0pHD8ozfZrXWxpw1n+csCWPOUaXoVmX1npMQtE+aEGRbJiVVCwezonNlLaBxnPsQat9JTB2QNEwzNpWLC4d0Lw3oHzgUnB2WDhYPVkMM/hm9w25iKM+lgR6TT1hIwrsS4ymXEYLReO1/vm11aqWZOs/yBsktli0Ml5LrE1elnRarMD4euoEXidYKJ145ieCfntZD1Ph9IFmzj7DP+BlVDUg5qlf0/udhWICA/EjdOzeKZc+qv0DVCzKJM7ZzyxvE9b+iORoJo10cffGz/FrF4lDxm8yCdFY7V54uRB6rEaPKcD6fLcTTn2XhU730nsRtcKtkYjwVTgnDp2d2MqvGjdVpzDR7dHJSbeIh70skM2R04EA8V4Cqn2K6uzEvjh3j6pPsDMCX2QJ/+ngTfntGO0LogB0q3pOLHpnHyp37fviJl45u8PovDLB81S7O8tua/eOUTCgGjEIiv2Pzy9p4XO3XVe1lOh/dj41th4IAAA=) 2 | 3 | ```kql 4 | // Microsoft's 50-year journey mapped to "Just another Kusto hacker" 5 | // Key milestones in Microsoft's history with corresponding letters 6 | 7 | let milestones = datatable(Year:int, Milestone:string, Letter:string) 8 | [ 9 | 1975, "Microsoft founded by Bill Gates and Paul Allen", "J", 10 | 1980, "First international office in Japan", "u", 11 | 1981, "MS-DOS 1.0 launched with IBM PC", "s", 12 | 1983, "Microsoft Word released for MS-DOS", "t", 13 | 1985, "Windows 1.0 GUI launched", " ", 14 | 1990, "Office suite debuts (Word, Excel)", "a", 15 | 1995, "Windows 95 brings Start menu", "n", 16 | 1997, "Visual Studio introduced for devs", "o", 17 | 2001, "Windows XP redefines desktop OS", "t", 18 | 2005, "Xbox 360 unveiled for gaming", "h", 19 | 2008, "Azure cloud platform announced", "e", 20 | 2010, "Office 365 cloud suite announced", "r", 21 | 2011, "Skype acquired for $8.5B", " ", 22 | 2012, "Surface tablet line introduced", "K", 23 | 2014, "Satya Nadella named CEO", "u", 24 | 2015, "Windows 10 launched as free upgrade", "s", 25 | 2016, "LinkedIn acquired for $26B", "t", 26 | 2018, "GitHub acquired for $7.5B", "o", 27 | 2019, "Azure Arc expands hybrid cloud", " ", 28 | 2020, "Microsoft pledges carbon negativity", "h", 29 | 2021, "Windows 11 introduces new UI", "a", 30 | 2022, "Activision deal boosts gaming reach", "c", 31 | 2023, "Copilot AI tools launched in Office", "k", 32 | 2024, "AI integrated across all products", "e", 33 | 2025, "50th anniversary celebrated", "r" 34 | ]; 35 | 36 | milestones 37 | | extend 38 | Age = Year - 1975, 39 | Era = case( 40 | Year < 1990, "Early Growth Era", 41 | Year < 2000, "Windows Dominance Era", 42 | Year < 2014, "Expansion Era", 43 | Year < 2022, "Cloud & AI Era", 44 | "Next Generation Era" 45 | ) 46 | | project Year, Milestone, Letter, Age, Era 47 | | summarize 48 | Message = strcat_array(make_list(Letter), ''), 49 | YearSpan = strcat(min(Year), "-", max(Year)), 50 | EraCount = dcount(Era), 51 | MilestoneCount = count() 52 | | extend Context = strcat("Mapped from ", MilestoneCount, " milestones across ", EraCount, " Microsoft eras (", YearSpan, ")") 53 | | project Message 54 | ``` -------------------------------------------------------------------------------- /resources/sample-queries/sample-query-7.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA9VU7W7aMBT936ewUCUSKW0JG9W%2BmEYhQOhogQYoX0KGuJASEmrMCKh%2F%2B0J7jj7UrhND0xK28bNUsRv7%2BN57Ts61TRjKoDSaz2yLSQM8J%2Bcf%2ByYZuibpM3fOqOWMJJiGmElH6IDf2dlRrJzLLINHE0%2FGKxvw8DWYYwrHaF6wrm3W4dGWAU4LMIZ%2F3n8P9mC%2BXY6q9VKupjUKHFNLjEs3E1Y26qlKPZ%2B%2Fqau1RsM2W83GbNyaXk04pt1sO7hgP%2BCkxwbTz8vhbWltFhtJ88M4RZxlIsgFedcih6F7Iu%2FKXze0lI9Zi1ruOa4u9gXWKHsCkwhibM5O1GDWw7zEXkbE0kRu3bvO6eE4fG8daLTN5b%2B%2FjqPD66FfKR2TZQXFHmPy1yMb7HABdjAxg7%2BBTST9S2ACGXUOjRzvPD89%2Fz7mg8QHlQ9JPnzig7zd7T0%2FxQ8N3kOPiHiMOCYqQcEUOyMiJRSEKcWrvk2cERtLGflEVZAqA3b664R4MwzwLMAzCsrBVELMRWw1I%2B6dZLtAMlCAIyA2xUPWx7YtxaVTOa4Adj7ENqbSBcRbjgklPEgaJeF1Rt17MmRItEqWp7StqcUgu4iae2%2B6%2FtyrazZK10uAZ0OCCn4KxHmjslAmmToPlNHgZG6rKXM5SLqU0XekvlRjhKvZYiLqMPane4lWh2iJIHse%2Ft1%2B2qgyvqX9OjafuO7jxSawU%2FzSEoBYOJbrAJtHNHcpQ4MVUMfzIQfAxJcX0ymm1pqgJhyZ4gnp29acSXWFVyeHklAys%2FGQ9CkZEU%2Fa3sRNSPgj3ul2urGu0u31wJWxWNhrAaUCRH9j0kQouM4v%2FJBRhSatXdvDjztfl%2Fd0m5rakb8VZYGdRgtV01JQ25d0DExLAC6m1YBGMbKgTVF5IPuu%2Bmn%2FPVWM8vEVwIv%2FK%2Ba9azloYjlm2iZ3zF0wQtHbeyps4kq0BarRN18lBCnvZVEVLECiMI9qFIfyXwxR5dvbfNdbb5ShS15ztRyHUOi6hwVBUmF3CxZlBC1ZjGYOzmupUEyoH9pgRsFg08M6b14%2FzDHX9vSaa3lMrdGYneqh9avQegXOu9SECiBA6R%2FdXw3ybQo0xqRGHhYWJeaNLxcX%2FJDr4A8Ot1yP1AkAAA%3D%3D) 2 | 3 | ```kql 4 | let A = split(base64_decode_tostring(strcat( 5 | // 6 | "MDAwMDAwMDEwMDEwMDAxMTAxMDAwMTAx", 7 | "MDExMDAxMTExMDAwMTAwMTEwMTAxMDEx", 8 | "MTEwMDExMDExMTEwMTExMXwgQUJDREVG", 9 | "R0hJSktMTU5PUFFSU1RVVldYWVphYmNk", 10 | "ZWZnaGlqa2xtbm9wcXJzdHV2d3h5enw0", 11 | "MTAxMzEwMTExMTIxMDExMDEyMTAxMTE5", 12 | "MzExMDExMjEwMTUxMDEyMTIxMDExMTMx", 13 | "MzE0MTExMTEyMTAxMTk1MTAxMTIxMDEx", 14 | "MTEyMTAxMTAxMjEwMTExMzEwMTIxODIx", 15 | "MzE0MTEwMTEzMTExMDEyMTIxMDEzMTEx", 16 | "MTEyMTAxMTI", 17 | // 18 | "=")), "|"); 19 | let B = datatable(I:string) [ 20 | // 21 | '[̲̅$̲̅(̲̅1̲̅2̲̅8̲̅)̲̅$̲̅]̅' 22 | // 23 | ] | extend J = range(0, array_length(A)-1, 1) | mv-expand C = A, D = J to typeof(long); 24 | let C = extract_all('(.)', toscalar(B | where D == 2 | project strcat(C) | limit 1)); 25 | let D = datatable(I:string) [ 26 | // 27 | '[̲̅$̲̅(̲̅1̲̅2̲̅8̲̅)̲̅$̲̅]̅' 28 | // 29 | ] | extend L = range(0, array_length(C)-1, 1) | mv-expand K = C to typeof(string), L to typeof(long) limit 256; 30 | let E = D | where tolong(K) > 1 | extend T = range(0, tolong(K)-1, 1) | mv-expand T to typeof(long) limit 256 | extend U = 0; 31 | let F = toscalar(D | where tolong(K) <= 1 | project U = tolong(K), L, T = 0 | union E | sort by L asc, T asc | summarize W = make_list(U, 256) | project replace_regex(tostring(W), @'[\[\"\,\]]', "") | limit 1); 32 | let G = B | where D == 0 | project I = strcat(C) | extend Y = extract_all('(....)', I) | extend J = range(0, 15, 1) | mv-expand Y to typeof(string), J to typeof(long) | project Y, Z = tohex(J), H=1; 33 | let H = extract_all('(........)', F); 34 | datatable(I:string) [ 35 | // 36 | '[̲̅$̲̅(̲̅1̲̅2̲̅8̲̅)̲̅$̲̅]̅' 37 | // 38 | ] | extend J = range(0, array_length(H)-1, 1) | mv-expand N = H to typeof(string), J to typeof(long) | join kind=leftouter (B | where D == 1 | project P = strcat(C) | extend Q = extract_all('(.)', P) | extend M = range(0, array_length(Q)-1, 1) 39 | | mv-expand Q to typeof(string), M to typeof(long) | project Q, M | extend O = tohex(M, 2) | join kind=innerunique (G | join kind=inner (G) on H | project P = strcat(Y, Y1), I = strcat(Z, Z1) 40 | | sort by I asc) on $left.O == $right.I) on $left.N == $right.P | order by J asc | summarize W = make_list(Q) 41 | | project TheRequiredString = replace_regex(tostring(W), @'[\[\"\,\]]', "") 42 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-75.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAIVW227jNhB911fM6mVtwJfu6xZBkWbdJG2SpnF62W4WAW2NLW4oUiVpe1X44zvDi+wWiKvAQoY8ZzgznIumUzh3IEDJFXrZIMyXZuNB6AoabBZowazA17RuGgFXqJTURsO9Ne7FtEYX0ykMAscx8tIiLnEI11CLLYJQO9E5QP3FdFiBluuadFdb1H5j0Y2YvZO+hlpWFWrQxqMDbzup1+ANVLjs2pqMaNA5sUY3gdkWbQdsKpOFJuVbVKYl9TvhYGU2uhqB9EESsNHyrw0Cfm3RStRLZLV0AHvIClaSPGWPd7WIHKmdrHB0WGDv0/kTeCD3tFfdCK6ZbkmUWzqbQSujlNmx6Qk+AoX+rWM3bNd6tsqbNRLWvmF2eJ5PPxmX0DC7u3j4eP84+wC3s/n8/HKW1p8SkF7jU0+PpN8eTj37DJ1GASZMn0z4N4ExLdO/40mCJuw+SowMuAnQH4GmhIzkcOg+gJ8iOKpjyjRRWO+YFxk8jfY+RWzQ9pq9CUrY/cmg7nskPP1P/BnI2Kumadg2ukNlzIujinmhZKolZQwn2q2xDuHCVPgGbsKttxZbYZGyy7ICSgVwXnhsKIEc5ReyaH0sgKMkowwMYk7sgpkzHVIIq9sEOoOifOVCTgT/9VDzJoPLb9nYO7Prc5dKBINBBxfBi4Wi9G6EX9aAgl6E9lSoK2OjvCRYsDywAukMKkEBYOogwt87b6leSBGDbo7XhsWngu+nPC9HQJ7SO4jfszgm08NCeRHFcRI/pN2ILmeBS6+o6ocg9uDLAB5n8FXczZqvo5jP/TGaMSZDorKf0smJfRP3M/s26s7suwjO4s9xt9d1n5Qn8i/JsEgvH5LqdNI82ZnExwDOmn5NLqbN3xI2afo9nZN2/0jRSrsfk0e9sj+THZO8ALwwLYvPOUlyh1tYFC8hSRz1Orr1nMvxMimlqe1SsxbWio4HBbVduZXVRqiUVq5rFka52NRDP9Ww2EhVheHkfCYtaUCsrGngm9DJ6US9yXMq6+C0O8ooR5lnhebKqr4ekYMxzwr12tcD1yrpB/8tsxH7PBxSzbwjV7CFd8WeholHno+HE+gAb6KrJxV9IgM+D0dgbBVIJIZIPv5renwx1AF2UimqL+oxjkYlOUrTKBRWjmwquNA9JE3f1jjpJc1mVkgtKdQmT8XcXiwq3ArtMzO1mUN9hsosjgNHzgZjXijyZ1JrYg1CJvSkInbe0yE5Wh4WQyAbj1boDGeoDS66FBbhluzCA7qN8slKDWvBY5P8iakUOCRFCifIqN+Ra636zMufGDzjHTdk4U1wzG2aRlj596HvnjFnKfxzSIwBB/+ZNadmRfdWlkPWNzfx8+CtS4063XWv6br/MPgO3o+H/wBcFOLiZQkAAA==) 2 | 3 | ```kql 4 | // As a lifetime Scout and member of the Soma Hellinon Proskopon 5 | // (Scouts of Greece) I have always enjoyed night adventures, 6 | // with hidden notes trying to decypher messages. Every time 7 | // an enveloped was found, it was a unique experience to try and 8 | // find out what was inside, what was the message. Recently, I 9 | // received the following message, let's decrypt it together! 10 | // _______________________________ 11 | // / ENCRYPTED MESSAGE \ 12 | // / ----------------------------- \ 13 | // / | | \ 14 | // / | .--- ..- ... - / .- -. | \ 15 | // | | --- - .... . .-. / -.- ..- | | 16 | // \ | ... - --- / .... .- -.-. - | / 17 | // \ | . .-. | / 18 | // \ |_____________________________| / 19 | // \_______________________________/ 20 | // 21 | // Hmmm... it looks like this is a Morse Code! Let's prepare our 22 | // let statements, we start with the message in the envelope 23 | let EncryptedMessage = 24 | ".--- ..- ... - / .- -. --- - .... . .-. / -.- ..- ... - --- / .... .- -.-. -.- . .-."; 25 | // Now let's define the Morse Code table, match each letter for each code 26 | let MorseCode = datatable(letter:string, morseLetter:string) 27 | [ 28 | "A", ".-", "B", "-...", "C", "-.-.", "D", "-..", "E", ".", 29 | "F", "..-.", "G", "--.", "H", "....", "I", "..", "J", ".---", 30 | "K", "-.-", "L", ".-..", "M", "--", "N", "-.", "O", "---", 31 | "P", ".--.", "Q", "--.-", "R", ".-.", "S", "...", "T", "-", 32 | "U", "..-", "V", "...-", "W", ".--", "X", "-..-", "Y", "-.--", 33 | "Z", "--..", 34 | " ", "/" 35 | ]; 36 | // Now, let's break the secret message string into an array of individual Morse symbols 37 | // and then build a list of indices from 0 to the number of symbols 38 | let morseLetters = range idx from 0 to array_length(split(EncryptedMessage, " ")) - 1 step 1 39 | | extend morseLetter = tostring(split(EncryptedMessage, " ")[idx]), order = idx; 40 | // The following join will make sure that each message letter with its position 41 | // is matched with the relevant letter in the MorseCode table 42 | morseLetters 43 | | join kind=inner ( 44 | MorseCode 45 | | extend morseLetter = tostring(morseLetter) 46 | ) on morseLetter 47 | | sort by order asc 48 | // Result in then gathered into a sorted order list, into a signle string 49 | // without separators 50 | | summarize message = strcat_array(make_list(letter), "") 51 | // So, what's the encrypted message I received? :-) 52 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-76.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAAA4VW34%2FaOBB%2B568Y5SmpCD%2FabR%2BoqFRV6p3arrS602kfqgqZZEhcnDiyHVjau%2F%2F9xjYxhoU2qxXYfPPNN%2BPxTKZT%2BNRrA%2B9baWpU8JkWEv5kxZYW2Bp1gFThZgG1MZ1eTKcVN3W%2FnhSymTa8UFLLjZl%2BJ6uceYp8ayny2lFko%2BkUPsi2wM4s4CNvSyAMNJJcdkqu2VogaPKDBIE9cYPusOAbjiVow5QBRjZI%2F3upSg28BQYbrsgfrUnjPVNbuSPGEoV19r43tVQLgEcuBGcN3Bd%2FyL6qId37jaao7NpGkI0EGqjQ3JOeL3yL4vD3UcujlbKE1Ll6JFcLbRRvq7FgZ%2Bvs5wjosTxrXinyt4SSGfqjyNKNks1qH1mDkedrnwQuuDksFDKRgeP76j%2Fsk9jzScb%2B%2BzHHbjmbvBlfR20oz8fvhHp5A1UwU9THxTnqQSDT6H664Lq7gTrninVFihNXXAH1%2BgbqAZW4rj5GlewwgH6B8lXogbPJPEJFcSUED1zzySxCRXH9AhXFdeHx9Q0UPnVCKo%2BbTV7dQPV6YHp2QqccXXi8u4EqcYdCdg54fkJRJhPehhAvYoyiv%2FD48gbK1Bw34bTvbqDWdL%2B5%2BR0XNRq5vVqrkeKkY4qV3NdkUP%2FtrfswUhdMMJUGU39fw%2FJfaNgWc9rraggXF%2FL83XBpXX9atdRpVrxcuh3b3ejaGqSu5C17TffaNbln%2FA6QN7akoDgUAvUyaWWLCaSu1WX510K2LRaGy1a%2FmE8m89m3%2FF1aoja8ZXY3C3R7KnH0LXLipCyXEJqVa5qRWUAM3SvQUP%2F5Tg5dwNS6TnzUmphrgQ3r0khWaGHZGPbIq9roa6Cor2XWxLbFSz2UvL%2FQ9IpauhAgNy5rlJDcJofTaTkJGtL5DGrZaZAKNrinqQJrNHvE1lmcBsZHG7%2BL%2FQvF6SdGlP8Qay%2FEgw%2BOKcUOK1JOFz3tqKxXbsc17mxs3Udh2ulS%2BgEmFa9oFLkwKDi75dLlrCOX%2BGTs7AoTzmZYka%2FBzVHJOIEkAz8qd0hD75zQumAnEj874sLd5azrxOGolLwMkmULp4K3j%2B6bhin%2BA6Hom17QaezwcbCirpQSIBWySo204yj1RBk9LvyOcvjEG1vwZG14Z8%2FJnqg9vugUg%2F%2BzXSwr1L7UtOwVhUKBRWURlGZRcCfFTFWrhj2ll8rHL5y4B15snZuaNok0H2rQHELurlRDSOupHO3rjC8tl%2BlB%2Fu94s9F%2Fb0cdWRh4%2FkLxT0tvK3S8RMkIYS%2FNzReP01vH8jixh3u7HHpv9j9IaS5OuQkAAA%3D%3D) 2 | 3 | ```kql 4 | // Just Another Kusto Hacker entry (ref: https://github.com/microsoft/just-another-kusto-hacker) 5 | // Concept: Find the most probable sentence with specified start and end words in a first-order Markov model 6 | // Author: *** 7 | let getMostLikelySentenceWith = (firstWord:string,lastWord:string){ 8 | let bigram = datatable(from_word:string, to_word:string, probability:real) 9 | [ 10 | "Just", "another", 0.6, 11 | "Just", "find", 0.2, 12 | "Just", "catch", 0.2, 13 | "Please", "find", 0.4, 14 | "Please", "catch", 0.6, 15 | "another", "Kusto", 0.5, 16 | "another", "Perl", 0.2, 17 | "another", "day", 0.2, 18 | "another", "hacker", 0.1, 19 | "find", "the", 1.0, 20 | "catch", "the", 1.0, 21 | "Kusto", "hacker", 0.5, 22 | "Kusto", "explorer", 0.3, 23 | "Kusto", "user", 0.2, 24 | "Perl", "hacker", 0.4, 25 | "Perl", "developer", 0.6, 26 | "day", "in", 1.0, 27 | "the", "hacker", 0.2, 28 | "the", "thief", 0.4, 29 | "the", "bandit", 0.2, 30 | "the", "crook", 0.2, 31 | "in", "paradise", 1.0, 32 | ]; 33 | toscalar( 34 | bigram 35 | | make-graph from_word --> to_word with_node_id=word // Create a graph using the bigram 36 | | graph-match cycles="none" (start)-[connections*1..10]->(destination) 37 | where start.word == firstWord and destination.word == lastWord 38 | project from = start.word, path = map(connections, to_word), weights = map(connections, probability), to = destination.word // Return all of the non-cyclical paths (10 hops or fewer) between the specified First and Last words 39 | | project fullPath = array_concat(pack_array(from),path), weights // Add the origin word to the path array 40 | | extend sentence = strcat_array(fullPath," ") // Convert the path array to a sentence string 41 | | mv-apply weight = weights on ( 42 | summarize cumulativeWeight = exp(sum(log(toreal(weight)))) // Approximate multiplication of all of the weights of all of the edges from source to destination 43 | ) 44 | | summarize arg_max(cumulativeWeight,*) // Pick the highest-probabilty sentence 45 | | project sentence // Return just the string of the highest-probabilty sentence 46 | ) 47 | }; 48 | print MostLikelySentenceUnderConstraints = getMostLikelySentenceWith(firstWord="Just",lastWord="hacker") 49 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-77.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAJVV71MiORD9zl/RN/eF2UKHAWrr1KKuVm8Vf66KC4plUZlMgGgmmUoyIp73v19nMrCoW94tHygmme5+/d7rJorgXDPDpOVyCsFRYSwQqeyMaTjGBwUzQh+YDjZrUQR/sQmXDFJmuGYpqMLmha0JZvGmPPpWnkD3o0w77wO+S04VZsXAwv8cu69ccWnNeKJVNjZWI8L6q7Bwx4H6YiDHGlgIdCEwCXuyTEsiUmIJcAMIAkyR50pbljZgxiRlQOCRaE4SwWDO7awMXwaCL7ZZAt0lhn3uHMqqr5vWYJH2Bk0ynBej65k43Itjmj3d3wzP1Kj/xdL2riHXF9OT4c2U9C6btHf6+WSxtbi5psWoJZqkN+Dp9Zmg2dljIi9FIi+Km9aWPWkeCSovbD/bL77vbV2NhmdXN+2jnPYun0/aR2IkTx/JwWA26p0+JsP9POFb5+nBTFC+xUfD/fuk1Smw1tPh15lIDp4e++3Bc3rwR3kW7EAUrbNS31PSoubbVafhbTCzNjfbUaTJfHOKhBRJYZim/r1NqrJol2m7cUTkedRntE81z62JNJuYaMZIaqKMcBl9c3pH96j3RiX+xoMTf8OLvxFv5iYO7jzn9YnSGbHdwD7ZoAF8KpVm+1wbe8mo0ml3nwjDvMp9y3KIt+GcaMOAOzkaYDWRRhDLIHfHKXzXAtBpxdJPRKaQFFykpb6+2Y+8CQlxaZQs3991kd5qV6VTJoWklivpnVFCSZfOSEqfjFNW2teqyrBr9gl31sIc0i6sXivxo+mzDCGPBU5ZfS19A4I5l6mamyC87dy9TWRVNUD/PT+rmCrHuxa7sJyxbUgXkmScNjzdS89UpyH8XQP8oARTFARcFWg69onWZDEWTE7tbJkshA2IUQAnYhn2ArlW94xaGDC9OFFyuqdEkcnVBtEsF4SyJXCKPNY5dLsQt5GO46BRpilPWi08eahOTJG87bVRQUIK2dNYTervmUMvObKWcG/5XRg2IHZfQYzeDCAIa/94zhDi+Q+63jJY/+lma/xELW/sKzSaX6SgJpXNgRIJgqNLP/BqA51t0afEuiVnlQJGzAI0n87sn7/BduiyY1XLcaPhnMyZ3i7xuxqxy/vFpy2z9sqk2M9ad7UXZBMdqfkz87XP1bx8CRmmxI5LWusZeWBjh7b+Mykdg4FvtUceyxny0398cdJAlU0hLA6qZs5JqcrQbbbsP2FVc34Y4yZ+gGqG456CxlnAxV7FA8kZ0rsJv7sjbh781Zzo1I9qPxfcDnGluL8Y4x7qOHqUCKLrH9HxAhabQx94B3j994s1l75zv8f5zu1u/eIyGhBRsHh98n9Au/UWdDTUQ/gEnfAO65YRrV+OaP9yROf/R3gevsr0gGRuBlaMvHJMSlWBkTyEZFE1vmxnCXJZGuPmSD1b8dNdk+y2eVcu8iUTr+7itbv2m7vW2l3nzV37rrYSZaXmK1vnaIHq58fgK3PUfqw0n3CnliOXFlZOqwgL/wWPpLxpdQkAAA==) 2 | 3 | ```kql 4 | // Presenting "Just another Kusto hacker". 5 | // Define desired output 6 | let DesiredOutput = "Just another Kusto hacker"; 7 | let DesiredOutputUnicodes = unicode_codepoints_from_string(DesiredOutput); 8 | // As per the rules externaldata is not supported, hence a variable with the external string. 9 | let Base64Input = "Y2VydHV0aWwuZXhlIC11cmxjYWNoZSAtc3BsaXQgLWYgaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL0JlcnQtSmFuUC9TZWNTY3JpcHRzL3JlZnMvaGVhZHMvbWFpbi9PdGhlci9iZWFjb24ucHMxIEhlbGxvS3VzdG8ucHMx"; //externaldata(Content: string)["https://raw.githubusercontent.com/Bert-JanP/SecScripts/refs/heads/main/Other/just-another-kusto-hacker-1.ps1"] with (format="txt", ignoreFirstRecord=False); 10 | // Step 1: Parse input, translate parsed Url to unicodes and build the string "Just another Kusto hacker" based on the BuildOutputTable function. 11 | let ParsedInput = base64_decode_tostring(Base64Input); 12 | let ParsedUrl = tostring(parse_command_line(ParsedInput, "windows")[4]); 13 | let ParsedUrltoUnicode = unicode_codepoints_from_string(ParsedUrl); 14 | let BuildOutputTable = (Desired: dynamic, inputContent:dynamic) { 15 | range i from 0 to array_length(Desired) - 1 step 1 16 | | project VeryLongColumnOutput = replace_string(case(i == 13, "K", 17 | i == 22, "k", 18 | substring(ParsedUrl, array_index_of(ParsedUrltoUnicode, toint(Desired[i])), 1)), "1", " ") 19 | }; 20 | let OutPutTable = BuildOutputTable(DesiredOutputUnicodes, ParsedUrltoUnicode); 21 | // The output of Step 1 can list "Just another Kusto hacker", but that is too easy right?! :) 22 | // Partial answer: 23 | let Step1JustAnotherKustoHacker = OutPutTable 24 | | summarize KustoPower = strcat_array(make_list(VeryLongColumnOutput), ""); 25 | // Have fun with KQL, results are random, it can be that in the 10000 created rows no result apears. #no risk no reward. 26 | let SplitWords = split(toscalar(Step1JustAnotherKustoHacker | take 1), " "); 27 | let FunOutput = range i from 0 to 10000 - 1 step 1 28 | | extend Value1 = tostring(SplitWords[toint(rand() * 4)]), Value2 = tostring(SplitWords[toint(rand() * 4)]), Value3 = tostring(SplitWords[toint(rand() * 4)]), Value4 = tostring(SplitWords[toint(rand() * 4)]); 29 | let EndGame = FunOutput 30 | | summarize dcount(i) by Value1, Value2, Value3, Value4 31 | | where Value1 == SplitWords[0] and Value2 == SplitWords[1] and Value3 == SplitWords[2] and Value4 == SplitWords[3] 32 | | extend Output = strcat_array(pack_array(Value1, Value2, Value3, Value4), " ") 33 | | project Output; 34 | print toscalar(EndGame) 35 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-78.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAMVVaY/bNhD9vr9iYKBYG1GC3SK9NtgCzTY9cjTpfWwDgxZHEmOKVEjKx7b97x2SkkXJu0CKFqg/GJY4b+bN45uxRAdPGpG/0ljDJVhncubmJ0Cf2TOhSq5rC7qAldT52mawrdAgML5B5VqDFlpVaMmz39UsiyjODOHgbYvWWRAKGGy1kRyshhWFPhhCb5BJ3VoomLLAtkw42ApXQSkRk4x7ZEb5nIU24CqEmpUi97/2FC8lWETKOgCQGgLJFLc5a5BY54YVDnnMnjOTZle4BUNEqE/cNVIb5BmscK8Vh1zXDUUnlK1jJvT3lOVreCzpO6MOSRV9aoGjFGXlkuyt2qCQHmAxNxgV8T00YoeSeVLKQ5ISnXJEH1bMOekbKIxAaqcSjQU3KSGx9GckrlF99kKKfI2BqJyk31JjaHq9Q7ywUBpfz3axQ/RLtWWGR63f6NYo3Gf0ZHRbVv4+DlRztiGiaeNUJXDxkh2c419ww0qtYGU8JGUWboeKsBJDTnqRxdIFyyO2VWult2pUSLjOHLmXiqKE8UZGVVK+ivnmCJIU2pGDzNpGdo32RcgBNvjZaSiE4iMR6r11JGZwuycts15njo2rbOTIxSb1FZPSI3wfhfbEeqkP08AkIRJapRR17a+G5q3SDQ5ViC0J7d8Hs6Q6r5HcTu3HXoQRIewwoD6FnTigy0qm8Y2Ltm6qeIUVoklSWx1HuSJ8FgdPbwT6/P7Bj+WD2cni0YmkJUIep25pgzRSuHm/UjKYUb4uBFWuOfJljdb6K76EUIecRw+CPK5rOPMXQCPG9ksZLnAeEi/gPpzTpWID5wH0Jw2row5CXcoUoq7F6/FhIYx1y7xihkKEKOYx+hJmM2IG9GXbFVmFugxHGZxlcL5YdFlsW5NRxA3SgrCtdIcFuQwM5zVb41IK6+ZDoQUlvqPhJa0jGag4HX/OJxEdjua8cMsNk22Q9BB9rNTHvSaHlrkohQsgodx8aG92/slHH5w9PHtITYvYZNrgpOTQWci3GBHr9Jxfn/pfp68vINbI4vkFec4t4I8gokcx2VRshW4p9RY9csZWOceirMSbtayVbt6Seu1mu9vfzB4dw9qmibDPHl99/uSLL7/6+umz5y++efnq2+++/+HHn37+5dffEhgNL+4OpcKTLuZjDhn03BdTYF/sCBgObgXSP0jqsZTAp5feUcMtTGmMgu9F/RbwHrz/ob+iOIe3fIYyke6dZTrSo+DjMkNTXVd9Ryd/xXvn6G16xdAycyWaKig0Ne/EBp2ZLoDvFatF/v85IrJP987xIBF12jdH83jn2ukV8yvhIPsE3Q3aGBi08ahEo2tBdzFaeunpYrLU/qHBbwO/s8nH4P/K6Pc7Fe6RAd/B7f/e8ncUTHx/tPGPTXPH6u9F6Re/TzQBj8cozXk8WFMTdX8a46GiMtMSfwMTCNjfyQsAAA==) 2 | 3 | ```kql 4 | let EpicPoem = strcat( 5 | "Kingdoms of blocks, where adventures unfold,\n", 6 | "daring quests in a world so bold.\n", 7 | "zealous fans await with glee,\n", 8 | "yearning for the magic they will see.\n\n", 9 | "epic landscapes, crafted with care,\n", 10 | "new realms explored, beyond compare.\n", 11 | "starring Jack Black, a hero's delight,\n", 12 | "unveiling secrets in the pixelated night.\n", 13 | "quests and battles, friendships tight,\n", 14 | "legends born in the flickering light.\n", 15 | "wonders await in this grand sight.\n\n", 16 | "Onward they journey, through forests and caves,\n", 17 | "under the stars, where the dragon braves.\n", 18 | "with courage and wit, they face the unknown,\n", 19 | "uniting forces, their strength has grown.\n", 20 | "x marks the spot, treasures to find.\n\n", 21 | "mysteries unravel, in the depths they dive,\n", 22 | "allies and foes, in this world so alive.\n", 23 | "glimmers of hope, in the darkest of nights,\n", 24 | "keeping the spirit of adventure in sight.\n", 25 | "in the end, triumph and cheer,\n", 26 | "soaring high, the movie of the year." 27 | ); 28 | let lines = split(EpicPoem, "\n"); 29 | let encoded_message = 30 | range i from 0 to array_length(lines) - 1 step 1 31 | | extend line = lines[i] 32 | | extend first_char = iif(line == "", " ", substring(line, 0, 1)) 33 | | summarize result = strcat_array(make_list(first_char), ""); 34 | let encoded_message_scalar = toscalar(encoded_message); 35 | let shift_values = toscalar(range i from 0 to 8 step 1 36 | | extend digit = toint(substring("19750404", i, 1)) 37 | | summarize shift_values = make_list(digit)); 38 | let shift_char = (['char']: string, shift: int) { 39 | let alphabet_lower = "abcdefghijklmnopqrstuvwxyz"; 40 | let alphabet_upper = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; 41 | let index_lower = indexof(alphabet_lower, ['char']); 42 | let index_upper = indexof(alphabet_upper, ['char']); 43 | let new_char = iif(index_lower >= 0, substring(alphabet_lower, (index_lower + shift) % 26, 1), 44 | iif(index_upper >= 0, substring(alphabet_upper, (index_upper + shift) % 26, 1), ['char'])); 45 | new_char 46 | }; 47 | let decodeCaesarCipher = (encoded_message: string, shift_values: dynamic) { 48 | let alphabet_lower = "abcdefghijklmnopqrstuvwxyz"; 49 | let alphabet_upper = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; 50 | let decoded_message = range i from 0 to strlen(encoded_message) - 1 step 1 51 | | extend ['char'] = substring(encoded_message, i, 1) 52 | | extend shift = shift_values[i % array_length(shift_values)] 53 | | extend index_lower = indexof(alphabet_lower, ['char']) 54 | | extend index_upper = indexof(alphabet_upper, ['char']) 55 | | extend new_char = iif(index_lower >= 0, substring(alphabet_lower, (index_lower - shift + 26) % 26, 1), 56 | iif(index_upper >= 0, substring(alphabet_upper, (index_upper - shift + 26) % 26, 1), ['char'])) 57 | | summarize decoded_message = strcat_array(make_list(new_char), ""); 58 | decoded_message 59 | }; 60 | let decoded_message = decodeCaesarCipher(encoded_message_scalar, shift_values); 61 | decoded_message 62 | 63 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-80.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEALVX34/bNgx+919BZC/O5rqWZPnHFTeg2GORPR32UhSB4qg9XxM7sJ01t27/+0hKjpX1sIcVu6I6UaI+faRIHv369f/xE/3LHmzMNLQXOJ4PU3s6tI2Z2r6DtoN353Hq4T/CfscPwsLbYddOgxme4dfLWzDdHt5eNjC2f9g97M2E/3YHO0L8pZ0e4XdzOKPQf4Tp+WRh359xcw2N6WBnoem7sd3bwe4J2IxwJIMbO6bw8GhHe5XnA7Mn8Cq0f7AjyuQPg1y+4eAxp0cLp6Hfn5vJ4V3S6GDn+RYh4R7ijbiLf1wnsJH0e/01AiClqd8O/ZetGQbzPJLewx3QPnxF78PDYLrxYz8cR/TD83IzrEgkSu6SFbH1GOgKRBwRH+AB/iRqTxap3VxzMs1nJ+FlqPrXm4VP0x9e5PMdhBDyfOwWTpaezUwWOtTpv8Rr3gHcGc/HoxnQz3BD42g+2+2hHaf4ZIbRbp/Gvot/o7dHartn+IUvuKLMNi8Ys403/sZHoZsX/Y3Au5b9BLZPfdu9s8+4vPphxbqjHVpzIIYs2stkMUSPgnC789ED4Gxnh9jBEwh8brv9/cfz4dCfJztAzGRv3B1vpHNEQEgi3qLxAqEbSl6eOUkCf5HTGjDPZ6xbOy54rH3CI4Rqx+2+n7Y+vNFfFMDOqOWlNvMD7cynGP9vKbricRqwnsSr4yoBnA/2FK8ynOtXKB1sF089TtruU3zluV5jgry0nMCVmHvvq7sdlX6YblYxLZvwYV+ZL+afh64xSIzPHXPerCOMEk5eioRreMcmE3e+uCRgMhkKKhTyUNCzsH4fiVSXCWRpIRMoeRRpmSdQp5lIojKVPMWxSGua1iXpVXkSValGr7nVko4JlYCiw1GeakV7qqaxqmm34oNKJVGRCsSTabDMIDiNZFrxni4Iq5Y0kkqdKsTFuebrE8jTXNNYOsWKLi14npc8aoKhiyoacdcbUdCtUhAxqUgnL8gWwZZnOfui5lEQjtBEquQblaSxZmMlUxOCSNWK9HNB68gEMcuaNDPelYEpRU67FSNkBSErPkVW4Ck1awrij2cFn3I6omTObIVkVvLqAc2OUZ55yUcLJlvNF+Y84hxJ4aNXTJlfMOPLaza3FASsa9ZUs06W1s4x+AY4en5kv6LnIAZZKiva1Dl5XAsGqEgn413UiTAgSmIveN35RfE85/fLXSQyPDuK3F5TFFblHE74Chw2mkYMXQKdfVewWQ6ZXjH64JNG3iTNLkyaXZg0uzBpdkvSYJ5kHJJzbOQ8YkThumA3lc7zkkbFnijZxYp3hTtFy+4oBg6NhfcwrmesWPOhkufqyl+F/CFuQgOa0IAmNKAJs75Zsp6EIhTKUKhCoQ4EkYVCyECEDETIQIQMRMhAhAxEyECEDETIQIYMZMhAhgxkyECGDKS+edGKw1xWPnopqznMM6HnEJcc0IKqD4UeB2BRz8VA+cQtODy1ngPBJSuHquIszbjWaE4jxfdmPvIpEBxYRUcjxwHrCOc2J5kWPtZpmSkrV9yWOqc4taluaw4ekRZOpaKsoEisuPa4CqHTXC31THKuFldg4StfLj0OZqbkden8xWnLRrn6yYuzvdJbWnD5qXh0maPyYvFqzZ5hPMFFqHRGsmbmVMr5b5Fm92eM5tIFNTnTarGUKC18Ts6Od8VT5v4PBDqi4LeRXCrkrF3wQuZLSs2eqfRSMIlT5d+jonIn3auwe7SLFMrUpa+OwymyOkrsFI5qTY059vdz/+60oL1t1emTAcXpcbDBd0CMQHAhJBoXqL0d24G+CrBPAnM6WWxD6cOAIPat+dR35jBD3l4b+08EbEnaFlwPNs6qzaMZTIP94LiOblr1b3p07HLoG2Vvm4MZsDb5hu6u7SbUzZIrC1pZA38cUY85TvYEI+bwNJwt3P+8sL3HVgt1Cen9KFIP+AFd6KfUA17X4ScQbyLmcW38CGq7EZeNvGyodLqWz3NeWnae+aZuvp16utVq/Tex0M0I9A4AAA==) 2 | 3 | ```kql 4 | ////////////////////////////////////////////////////////////////////////////////////// 5 | /////////////////////////// Matrix multiplication in Kusto /////////////////////////// 6 | ////////////////////////////////////////////////////////////////////////////////////// 7 | // Arbitrary NxA and AxM sized datatables (with values of type double) can be considered 8 | // as matrices. These matrices can be multiplied to result in a NxM sized datatable 9 | // as the product matrix. 10 | let matrix_mul = (M1:(*), M2:(*)){ 11 | let to_row_arrays = (T: (*)) { // Transforms any datatable "any NxM matrix" to arrays of rows 12 | T | project row_arrays = pack_array(*) 13 | }; 14 | let to_col_arrays = (T: (*)) { // Transforms any datatable "any NxM matrix" to arrays of columns 15 | T | evaluate narrow() 16 | | summarize col_arrays = make_list(parse_json(Value)) by Column 17 | | project col_arrays 18 | }; 19 | to_row_arrays(M1) 20 | | project M1 = row_arrays, _joinKey = "#" 21 | | serialize 22 | | extend m1_rownum = row_number() 23 | | join kind=fullouter ( 24 | to_col_arrays(M2) 25 | | project M2 = col_arrays, _joinKey = "#" 26 | | serialize 27 | | extend m2_colnum = row_number() 28 | ) on _joinKey 29 | | extend m1xm2_ij = series_dot_product(M1, M2) 30 | | summarize M = make_bag(bag_pack(strcat("m", strrep("0", 5-strlen(tostring(m2_colnum))), tostring(m2_colnum)), m1xm2_ij)) by m1_rownum 31 | | sort by m1_rownum asc 32 | | project-away m1_rownum 33 | | evaluate bag_unpack(M) 34 | }; 35 | let m1 = datatable(a01: double, a02: double, a03: double, a04: double, a05: double)[ 36 | 1.57, 0.62, 7.62, 1.74, 9.01, 37 | 7.2, 9.02, 6.9, 9.97, 7.84, 38 | 8.5, 5.9, 9.7, 1.13, 3.74, 39 | 4.53, 5.39, 5.89, 1.87, 7.33, 40 | 6.12, 2.9, 1.87, 7.9, 9.87, 41 | 2.82, 2.56, 3.92, 3.87, 9.34, 42 | 3.85, 7.8, 4.45, 4.76, 3.98, 43 | 4.66, 3.47, 3.45, 2.12, 8.12, 44 | 4.02, 6.96, 1.21, 5.23, 2.46, 45 | 8.12, 1.04, 0.69, 0.61, 3.15, 46 | 2.78, 4.32, 4.97, 1.22, 3.11, 47 | 3.93, 0.41, 1.98, 2.79, 4.01, 48 | 3.26, 3.92, 3.64, 2.87, 1.06, 49 | 2.31, 1.76, 2.73, 3.92, 1.45, 50 | 3.12, 3.31, 1.17, 5.22, 6.25, 51 | 2.25, 4.76, 5.85, 3.69, 0.7, 52 | 3.16, 4.98, 2.87, 4.87, 2.81, 53 | 1.58, 0.45, 5.06, 2.91, 3.71, 54 | 2.59, 2.83, 0.45, 0.94, 0.64, 55 | 0.6, 1.45, 3.13, 7.76, 0.28, 56 | 0.54, 8.51, 2.88, 3.06, 0.76, 57 | 5.37, 6.18, 3.26, 3.38, 3.48, 58 | 4.47, 0.6, 1.44, 2.78, 9, 59 | 7.87, 5.39, 4.3, 1.85, 1.57, 60 | 5.3, 2.73, 6.58, 3.26, 0.69 61 | ]; 62 | let m2 = datatable(b01: double, b02: double, b03: double, b04: double)[ 63 | 0.56, 0.69, 0.49, 0.02, 64 | 0.13, 0.79, 0.72, 0.38, 65 | 0.78, 0.33, 0.19, 0.4, 66 | 0.49, 0.11, 0.16, 0.45, 67 | 0.03, 0.98, 0.73, 0.3 68 | ]; 69 | let m3 = datatable (c01: double, c02: double, c03: double, c04: double, c05: double, c06: double, c07: double, c08: double, c09: double, c10: double, c11: double, c12: double, c13: double, c14: double, c15: double, c16: double, c17: double, c18: double, c19: double, c20: double, c21: double, c22: double, c23: double, c24: double, c25: double)[ 70 | 0.89, 2.28, 0.28, 1.24, 0.015, 1.45, 2.54, 1.34, 4.39, 4.69, 4.32, 3.76, 2.67, 5.55, 0.79, 1.17, 4.3, 3.25, 0.23, 5.94, 3.89, 0.38, 3.11, 4.32, 8.79, 71 | 1.24, 1.95, 4.5, 3.51, 1.57, 1.99, 2.35, 2.1, 3.45, 2.37, 2.74, 5.73, 1.65, 2.18, 6.78, 8.64, 3.69, 5.43, 4.32, 4.21, 2.69, 2.35, 1.61, 3.42, 1.65, 72 | 4.25, 1.29, 2.2, 3.35, 0.3, 2.4, 2.27, 4.3, 2.23, 5.66, 4.86, 4.56, 0.346, 1.45, 2.9, 3.29, 2.15, 5.71, 1.56, 0.05, 2.97, 1.74, 5.34, 0.86, 0.45, 73 | 1.52, 0.91, 0.45, 0.51, 0.02, 4.3, 3.12, 3.24, 3.98, 6.69, 1.23, 6.2, 0.02, 6.23, 0.85, 1.93, 4.85, 4.87, 2.56, 8.95, 4.8, 7.25, 3.52, 1.55, 1.4 74 | ]; 75 | matrix_mul(matrix_mul(m1, m2), m3) 76 | // The result matrix is the product of the three matrices ((m1 x m2) x m3) 77 | // The desired text appears in the diagonal of the result matrix (as the ascii numbers of the characters) 78 | | project row = pack_array(*) 79 | | scan declare (row_num:int = 0, diagonal:int) with ( 80 | step s1: true => diagonal = toint(row[s1.row_num]), row_num = s1.row_num + 1; 81 | ) 82 | | summarize diag_M1xM2xM3 = strcat_array(make_list(make_string(diagonal)), "") 83 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-81.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAG1XXW/iyBJ9n1+B8rIZLVfrj7AbdJWHTXZshsx47pDExv0S2W4nNrSNhY2x0fz4e6raBBItEgLa3fVx6tSpRqXNqG422/7Pq9HN6OKpcKq47K5j1zlErr9+mXWZsGjNM/DdwNr1y0xWcbFopY19lrh+cc0JPwsm9JklrtNL11Rx+bPG7yZazvvYnuOMxNnFRiy768RetElh4uy8F0upn7lql1hqTc/jpcLvTIXBzx1szPG2w6WHtQVsyR18lVgbYp2WST+5fvlitjKYGGEAO8fYyF9gkI1bWgvJt+Wv5HJeyRn5cHZh0E0QD32nHB9F4JlJoYz0yemF7x++zY7xVG0If9JyDtinEttDjosK5+sUdqU7hT/PCJdzpWNbtG+YuU6eLj0614qSY+hl4feEV2gvKkn+YCMMJoT5JrZvycYhtkwl3WzAx8xiV62iYGpSLog5SwquUR4G3vYb7PoW1cc/iAD5ON4+nvm7iLFRhsbwf/nrvbiXS65nARwVnXuyulb2HXx4NTDcpg8dYyOQuyj8WhIGrtpSbeRsPhnwN2LCuXCsKJCZ1HnijZxK1WOPEc0IL8WfhL0owA8rq7F/QzYTd2oL4EV+cGY4n2Ux4sM6cQ3182uKcbEUKqE9M8fEM+ZcbE23hCHxQCwXKikmqOu65rWCauq18fK2FsuM+QXMD9JVZbhcVLE1oXqwf71/SrWimuw4PuCdFE9v/Ittv6Y4E9RG2zbBYcIbtgLuiywiu1wr0SZUZ/IXdAbVS1JeJdXYM2Tg1PEZ/9JC7YTeo+IH1Msh3k4o/kzb1n0jrawi/0n5HXHt8web8rmuv5Iv128Tt2PeoAfWx/6IwIehl4HXROk+mFOvrE/89FpRCMW9FzirCFgJiuPH/d8luHO1uRPJ7/d/V8Wion3Iayfv/spf5+hhYPJodWTLCynmL8gh6NrQqqkOreQ6zhX3NjjBcRWiRz8bSYlenPk9+RU2egKf98wBk7FCvtRDK/RBg3ir0HIM5vbsFvyi+qih9zLogl8Sz4Q9N9F7hzMO9OnyFvoE/fhCmPhXR5vUb0nPfNH6MvP2InB6YJIJV9eENcNVdWxrv7FVqZC/ywp+iVcG8fOBccwywZx3+lj3ZsOYWqIgHcF+4C43tP/rmvVhx3Zd1AO1T/J9Tv1PZyLX4fMyMPMY9aPzX6Ep1HOhNW2o1in355Q4m4uAdHTC3CA+PBaOAeyhGd1k8J1Rz0UlODPjOmutJX4dueyy9qFm34+8B79IzzmXfWw1A78dwpv1IQyE7lXKbTk/aD1509hb2PWJc0M+hwSahE8zmR31mHQNevOlMWkucG1mxGutj6x1FMPsTNPfavLz1OvveUeYHbRfRVwowbUmoZ6beajBnvZsQuKSO2m1vk1XkcV5VvRbQJu4XwesEU+dUk/g2cOAIfjM9TxqIThzwH5g6JQUI/h6oF6neJJiaqMHdoJ1Vvv8eJ7nImkMfIpguuO+cH3CtyGtFnes5awv7/t30Ya231B/DdqGtekuJg7DBvr3kWu5nO9R3wPpt9Yf2caWxhCcNo+zbNivcdUzbei7gfNDDcIC94TAO/zQOO3A+ZV0hxwHnR5mBfaZ+5jvD4ssLDA/+0HneC6onmfwcAb+C2gpa+rb3C58SwQd5oxq43zAAXFg3aZYeQ4uvSq0eb5CGzzCVXOebN3RfaNrTxzWGi3ozqP5XceWZM0EhsjX3MsZ3TmcFWrHXALne54ZAWmah14TgxZ3czr3ZN/y/DzvNwk+xO6CtUFyj2HesbZD5/753sS4r0jMLtagYNASret/ENdeHPSZ7oU25nnjKcKauTDgdz5ngGMPDWu4XqgFxRIWfgYflSj9Ye4Iun8hvgU4xbO+joPpQf4gjcecwzzH/Y3z0jnwnWfQqsrUtSKt9Nc/hrmF550M/J74E9PdwYaG0n0E+oh61KI83SXobiCRa4SZzvkGE+p31k7d4xIzwTPiQYOPdwjkWepZru8m4OUKGs4zL2Xuv9bv7ouw8zaT0ffQOiM66jruPHQPe+s93Fsinl/A2+qqxHo9amAB3tHcwr2lUcPaoB0DFi7PTCW15hMX0XeSax5ajUr4nkr83X+4z2bEx1Nfv+s1wneyHvqHbDO2mP+Z1mqT8tlp7SK+T3SeJx1dHOvxeF6Pu+zb09O++vZ6c3Px30/VNi9P/wE+/RqlXZOWUq/sSv5fEEd1+ufVs0yTjUyfm03d4NDr5XDo84dDOLBNKxUl6fP5RrI1vvj162J8Mbo4O9Ns1mlZ41Bdqby5fG/98/i30W+0uWj/k3ZV9LYfS3W6zSOVH1J8r7abVZo0p4eD8WpT502+KSmmzf653BVxur0kg/ss3aZnz29G5tQafRrhtdm+W7+2/m3VNif/umzYJ+95KdMOrvOXl8vjppsb+Bmb4/dr19bY+rAEB2P745phj6/Gxme8CIDNthnF/eAmqhNa2xVFtAUoo3+4WvJ7WtfRa0r4Ntskap6j7TbqL4tonT6rvCbACbLP49FQliOU78//H7JbjmwpDgAA) 2 | 3 | ```kql 4 | let story64 = "UmFpbnx8bGFzaGVkfHxhZ2FpbnN0fHx0aGV8fHdpbmRvd3x8b2Z8fG15fHx0aW55fHxhcGFydG1lbnQsfHxtaXJyb3Jpbmd8fHRoZXx8c3Rvcm18fGJyZXdpbmd8fGluc2lkZXx8bXl8fGhlYWQufHxJfHx3YXN8fGRyb3duaW5nfHxpbnx8bG9ncy58fE1vdW50YWluc3x8b2Z8fHRoZW0ufHxBc3x8YXx8c2VjdXJpdHl8fGFuYWx5c3R8fGF0fHxTZWN1cml0eUFyZVVzLHx8bXl8fGpvYnx8d2FzfHxlc3NlbnRpYWxseXx8dG98fHN0YXJlfHxpbnRvfHx0aGV8fGFieXNzfHxvZnx8c2VydmVyfHxhY3Rpdml0eXx8YW5kfHxob3BlfHxzb21ldGhpbmd8fG1hbGljaW91c3x8c3RhcmVkfHxiYWNrLnx8V2V8fHVzZWR8fFNwbHVuay58fEl0fHx3YXPigKZKdXN0fHxmaW5lLnx8U2xvdyx8fGNsdW5reSx8fGFuZHx8ZmVsdHx8bGlrZXx8dHJ5aW5nfHx0b3x8bmF2aWdhdGV8fGF8fGxhYnlyaW50aHx8d2l0aHx8YXx8Zmxhc2hsaWdodHx8cG93ZXJlZHx8Ynl8fGF8fGhhbXN0ZXJ8fHdoZWVsLnx8RXZlcnl8fHF1ZXJ5fHx0b29rfHxhbnx8ZXRlcm5pdHksfHxhbmR8fGNvbXBsZXh8fGludmVzdGlnYXRpb25zfHx3ZXJlfHxhbm90aGVyfHxuaWdodG1hcmUufHxJfHx3b3VsZHx8c3BlbmR8fG1vcmV8fHRpbWV8fHdhaXRpbmd8fGZvcnx8cmVzdWx0c3x8dGhhbnx8YWN0dWFsbHl8fGFuYWx5emluZ3x8dGhlbS58fFRoZW58fGNhbWV8fHRoZXx8d2hpc3BlcnMufHwiS3VzdG8sInx8cGVvcGxlfHxzYWlkfHxpbnx8aHVzaGVkfHx0b25lc3x8YXJvdW5kfHx0aGV8fGNvZmZlZXx8bWFjaGluZS58fOKAnEl04oCZc+KApmRpZmZlcmVudC7igJ18fHx8T2xkfHxNYW58fEhlbWxvY2ssfHxvdXJ8fHJlc2lkZW50fHxpbmZyYXN0cnVjdHVyZXx8Z3VydXx8KGF8fG1hbnx8d2hvfHxjb21tdW5pY2F0ZWR8fHByaW1hcmlseXx8dGhyb3VnaHx8Z3J1bnRzfHxhbmR8fGNyeXB0aWN8fExpbnV4fHxjb21tYW5kcyksfHx3YXN8fHNwZWFyaGVhZGluZ3x8YXx8cGlsb3R8fHByb2plY3R8fHdpdGh8fGl0Lnx8SGV8fGhhZHx8d2FybmVkfHxtZXx8b2ZmLHx8dGhvdWdoLnx8IkRvfHxub3R8fGJvdGhlciwifHxoZXx8aGFkfHxtdW1ibGVkLHx8InRvb3x8Y29tcGxleHx8Zm9yfHxiZWdpbm5lcnMuInx8TmF0dXJhbGx5LHx8dGhhdHx8anVzdHx8bWFkZXx8bWV8fG1vcmV8fGN1cmlvdXMufHxJfHxzdGFydGVkfHxwb2tpbmd8fGFyb3VuZHx8YWZ0ZXJ8fGhvdXJzLnx8U2VjdXJpdHlBcmVVc3x8aGFkfHxzcHVufHx1cHx8YXx8c21hbGx8fEt1c3RvfHxjbHVzdGVyfHxhc3x8cGFydHx8b2Z8fHRoZXx8cGlsb3QsfHxhbmR8fEhlbWxvY2ssfHxibGVzc3x8aGlzfHxncnVtcHl8fHNvdWwsfHxoYWR8fG5vdHx8bG9ja2VkfHxpdHx8ZG93bnx8Y29tcGxldGVseS58fHx8SnVzdHx8ZW5vdWdofHx0b3x8ZGlzY291cmFnZXx8Y2FzdWFsfHxicm93c2luZyx8fG5vdHx8ZW5vdWdofHx0b3x8c3RvcHx8c29tZW9uZXx8ZGV0ZXJtaW5lZC58fEl8fGZvdW5kfHx0aGV8fGRvY3VtZW50YXRpb258fG9ubGluZXx84oCTfHxzdXJwcmlzaW5nbHl8fGdvb2QsfHxhY3R1YWxseXx84oCTfHxhbmR8fHN0YXJ0ZWR8fHdpdGh8fHRoZXx8YmFzaWNzOnx8Y29ubmVjdGluZyx8fHF1ZXJ5aW5nfHxzaW1wbGV8fHRhYmxlcy58fFRoZXx8Zmlyc3R8fHF1ZXJ54oCmaXR8fHdhc3x8YXx8cmV2ZWxhdGlvbi58fEl8fHRocmV3fHxhfHxiYXNpY3x8c2VhcmNofHxhdHx8aXR8fC18fGxvb2tpbmd8fGZvcnx8ZmFpbGVkfHxsb2dpbnx8YXR0ZW1wdHN8fGFjcm9zc3x8b3VyfHx3ZWJ8fHNlcnZlcnMufHxJbnx8U3BsdW5rLHx8dGhhdHx8d291bGR8fGhhdmV8fGJlZW58fGF8fDMtbWludXRlfHx3YWl0Lnx8S3VzdG8/fHx8fFVuZGVyfHxvbmV8fHNlY29uZC58fFRoZXx8cmVzdWx0c3x8c3RyZWFtZWR8fGluLHx8YmVhdXRpZnVsbHl8fGZvcm1hdHRlZCx8fGFsbW9zdOKApmVsZWdhbnQufHxJdHx8d2FzfHxub3R8fGp1c3R8fHNwZWVkO3x8dGhlfHxxdWVyeXx8bGFuZ3VhZ2V8fGl0c2VsZnx8ZmVsdHx8aW50dWl0aXZlLnx8SW5zdGVhZHx8b2Z8fHdyZXN0bGluZ3x8d2l0aHx8cmVnZXh8fGFuZHx8YXJjYW5lfHxzeW50YXgsfHxJfHx3YXN8fHdyaXRpbmd8fHNvbWV0aGluZ3x8Y2xvc2VyfHx0b3x8cGxhaW58fEVuZ2xpc2gufHxJfHxmZWx0fHxsaWtlfHxJfHxoYWR8fGp1c3R8fGFjaGlldmVkfHxhfHxuZXd8fGhhY2tlcnx8bGV2ZWwufHxJfHx3YXN8fGhvb2tlZC58fEl8fHN0YXJ0ZWR8fHNwZW5kaW5nfHxldmVyeXx8c3BhcmV8fG1vbWVudHx8bGVhcm5pbmd8fEt1c3RvfHxRdWVyeXx8TGFuZ3VhZ2V8fChLUUwpLg=="; 5 | print story64 6 | | extend storyun64 = base64_decode_tostring(story64) 7 | | extend story = replace_string(storyun64,"||"," ") 8 | | extend tokens = split(tostring(story),' ') 9 | | mv-expand tokens 10 | | serialize 11 | | project tokens 12 | | extend position = row_number() 13 | | where position == 192 14 | or position == 82 15 | or position == 315 16 | or position == 303 17 | | extend index = iff(position==192,1,iff(position==82,2,iff(position==315,3,iff(position==303,4,0)))) 18 | | sort by index asc 19 | | summarize DecodedMessage = strcat_array(make_list(tokens), " ") 20 | | project DecodedMessage 21 | ``` -------------------------------------------------------------------------------- /resources/participating-queries/query-79.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAL1XbW/bNhD+7l/BfZK0SkHkON2azAGK1MDQNsDW5Ns2GLR0sZXIpEBRsbO1/31HHvVi+XUf1gB2RPHuubvnXkjnoFkhi3vNlWZj5pdaXTH8ysQ8YP+wsprRwmyELA7NXg7CLIOAfbse5AQwEelx9fMNdRaxuIF4zFSpbxdcnYTS6uX8VLWe5S5IwdN7K2lQMlFUusYJWQplpiD9DGKuF1csExqxBwz/UCLh2udK8depWygoAP95515PE006Byx+EITM8/CLVgPnSCYSBUsQ+ldYG1+SSilcdaPScgFrX8tcUmCJNbdGe04Y0/KmE1sil2gBvlQ5EEdcQxvdtgEbWsJL8O0TBYo6bDxmHvcYx0Q7LfYDvnr0TFkclx072eEu2dk2boqyFyfIjp3sqJWNYvvYsOoo+AyP+jgFIctRrk+IhSFBx2SHV0JsE3C9g8MN5bFrJJM7Y61VDfcpDEPXZVZhv9wF+b93f7QPx/N2knZb0/zfeAuZyuaL70FjMzh8a/Egg/WwOM5htxH9o8kZ7YfeQ+sX4+sppH4vGusz4AQWXeG6DefiQTatxCH2HGS8DbaHv3saB6fOs/+BMJxvh0jCMXWIkUPao552nwJYF5xO24crJCBugq2jfbDfX1FQAwraAwrFcal4oqc8z33PPwtwaJZx4GSXL5HDXWV6Mc00LDORwnpsvwljE1ZBWeWmhrV0x6wVqgELJZ8g0RFfofESCSMIF8MLzysoUblATY0BQGFWios5mDIYnZu/YNB1zArhmxJUxvPsbzDPCRd40CY5V8D87gRCNM/r9Y95Z4Efva1ScfIb9cTsMRZYSga+O/ShYIZzrSrM1k2TpZxOl85Zg6k5c6WFT0274PPu8dNqu6F7GMA+9NtFubnSHTP7Yfra7pDdaLKd2tgjJjcux6zZNwmt71LmLpTzBKbtJWzrvGv6ne4G9kZ0GfRyXNebXIlqaYpErqb4NAPlG9FMvMhncF3hB1RfQqad8qIarsvrPBxebFYW7WvJ9GsB8tE3dysHBOkcKC6LxNMnDEkkpp9mOCHejqZYfWhs2nSBd/fh/cp91vb/w4Q+9t1kfftU709Ixu533v0uO/t2b20/tfyHyafGxsPErOljZUiuZ6P2Ye38WN+9H4+9bgq7gZVFnuG9tn6DeflTeJuM9YZEKSuVQAek5dLNpjaPmHaV2eTsGEgNwkFzmFtd46DcagHY/Q0ujudubVrX7G1cd1I6bGcP+V5XxyVeUXvl4SR69dFGlFbLpeHNmM2lfK4K9oyO4ugUoBjNDbJlHe9Z6s9fK9O3tTF5W3sBk4KWg97ErV8SNxbzpg5EolN11HhYXbDGrF26yqd+s3miHvjKKpGhPZ8ItBzxZ4jmiheLGjuKbgjKpMy1IerYvKGClY2WXCcL5os4iP6AH+Ozs/jdX9GNL4YmUPJYDM9c1xqXBqw7a+wvVRGTAI4QKKTSWGS/cTQ5RqcK3yXcjhJkgiscJe0ESWSF0zVgs1eCa3gi8F/wDL4e0BFlABDdiDp1Xiahmxj4uGGgOdVo1k3tkecbkqZ5Vppfh+bIpJ9+LeLuqnH02ww3crUr5Gff/B2UJZ+bUsa+EmVuprd3Hg8vRpdvf/r5HZ8lKZgp+xEHl6oSoT8tniXzwn3uUjjkbvAv+u3gISkQAAA=) 2 | 3 | ```kql 4 | let popStart = (str: string) { substring(str, 1, strlen(str)) }; 5 | let popEnd = (str: string) { substring(str, 0, strlen(str) - 1) }; 6 | let firstChar = (str: string) { substring(str, 0, 1) }; 7 | let lastChar = (str: string) { substring(str, strlen(str) - 1, 1) }; 8 | let padString = (input: string, desiredLength: int) { 9 | strcat(array_strcat(repeat('0', desiredLength - strlen(input)), ''), input) 10 | }; 11 | let incrementHex = (current: string) { tohex(tolong(strcat('0x', current)) + 1) }; 12 | let computeRule = (state: string, current: string) { 13 | case( 14 | state == 'a' and current != 'f', 1, 15 | state == 'a' and current == 'f', 2, 16 | state == 'b' and current != 'd', 3, 17 | state == 'b' and current == 'd', 4, 18 | -1 19 | ) 20 | }; 21 | let computeLeft = (state: string, current: string, left: string) { 22 | let currentRule = computeRule(state, current); 23 | case( 24 | currentRule == 1, strcat(left, current), 25 | currentRule == 2, popEnd(left), 26 | currentRule == 3, left, 27 | currentRule == 4, popEnd(left), 28 | '' 29 | ) 30 | }; 31 | let computeCurrent = (state: string, current: string, left: string, right: string) { 32 | let currentRule = computeRule(state, current); 33 | case( 34 | currentRule == 1, firstChar(right), 35 | currentRule == 2, lastChar(left), 36 | currentRule == 3, incrementHex(current), 37 | currentRule == 4, lastChar(left), 38 | '' 39 | ) 40 | }; 41 | let computeRight = (state: string, current: string, right: string) { 42 | let currentRule = computeRule(state, current); 43 | case( 44 | currentRule == 1, popStart(right), 45 | currentRule == 2, strcat(current, right), 46 | currentRule == 3, right, 47 | currentRule == 4, strcat(1, right), 48 | '' 49 | ) 50 | }; 51 | let computeState = (state: string, current: string) { 52 | let currentRule = computeRule(state, current); 53 | case( 54 | currentRule == 1, 'a', 55 | currentRule == 2, 'b', 56 | currentRule == 3, 'a', 57 | currentRule == 4, 'b', 58 | '' 59 | ) 60 | }; 61 | let expand = (T: (s1: string)) { 62 | T 63 | | extend array = extract_all('(.)', s1) 64 | | mv-expand with_itemindex=index array 65 | | extend result = tostring(array) 66 | | project-away s1, array 67 | }; 68 | let values = print steps = range(1, 400000) 69 | | mv-expand steps 70 | | serialize 71 | | scan declare (left: string = '', right: string = '00000f', current: string = '', state: string = 'a') with 72 | ( 73 | step s1: true => 74 | left = computeLeft(s1.state, s1.current, s1.left), 75 | current = computeCurrent(s1.state, s1.current, s1.left, s1.right), 76 | right = computeRight(s1.state, s1.current, s1.right), 77 | state = computeState(s1.state, s1.current); 78 | ) 79 | | project state, s1 = padString(replace_string(strcat(left, current, right), 'f', ''), 5) 80 | | serialize 81 | | extend rownum = row_number() 82 | | invoke expand(); 83 | let nodes = print index = range(0,23) 84 | | mv-expand index to typeof(long); 85 | let edges1 = print adjacency = base64_decode_tostring('MDAwMDAwMDAxMDAwMTEwMTEwMDAwMDExCjAwMDAwMDEwMDAxMTEwMTAwMDAwMDEwMQowMDAwMDEwMDEwMTAxMTAxMDEwMDAxMDEKMDAwMDAwMTExMDExMDExMTAxMDAxMDEwCjAwMDAwMDEwMDAwMTEwMTExMTEwMDAxMA==') 86 | | project adjacency = split(adjacency, '\n') 87 | | mv-expand with_itemindex=source adjacency to typeof(string) 88 | | extend entries = extract_all('(.)', adjacency) 89 | | mv-expand with_itemindex=dest entries 90 | | where entries == 1 91 | | project source, dest; 92 | let edges2 = print source = range(5, 23) 93 | | mv-expand source to typeof(long) 94 | | extend dummy = 1 95 | | lookup kind=inner ( 96 | print dest = range(5, 23) 97 | | mv-expand dest to typeof(long) 98 | | extend dummy = 1 99 | ) on dummy 100 | | project-away dummy 101 | | where dest > source or (source == 23 and dest == 23); 102 | let rownums = edges1 | union (edges2) 103 | | make-graph source --> dest with nodes on index 104 | | graph-match (n1)-[e*1..19]->(n2) 105 | where n2.index == 23 106 | project start = n1.index, reportingPath = map(e, dest) 107 | | summarize rownum = count() by start 108 | | where start <= 4; 109 | values 110 | | sort by rownum asc, index asc 111 | | summarize values = strcat_array(make_list(result), '') by rownum 112 | | lookup kind=inner (rownums) on rownum 113 | | sort by start asc 114 | | summarize Message = translate('0123456789abcde', 'JaserucntKhko ', strcat_array(make_list(values), '')) 115 | ``` -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 |
2 |

Welcome to the
Just another Kusto hacker ("JAKH")
contest! 3 |

4 | Kusto logo 5 |

Inspired by the Just another Perl hacker ("JAPH") challenge,
and The International Obfuscated C Code Contest

6 |
7 | 8 | --- 9 | 10 | In April 2025, the following challenge was presented: 11 | - Write a Kusto query that outputs the string `"Just another Kusto hacker"`. 12 | - The query can be as simple or as complex as authors like, as long as it is self-contained and can run on any Fabric EventHouse or Azure Data Explorer cluster. 13 | - [Free Azure Data Explorer clusters](https://learn.microsoft.com/en-us/azure/data-explorer/start-for-free-web-ui) or the [Azure Data Explorer Emulator](https://learn.microsoft.com/en-us/azure/data-explorer/kusto-emulator-install) could be used for testing. 14 | 15 | Participants were given the opportunity to vote on the most creative and innovative queries across multiple [categories](#categories). 16 | 17 | [Sample queries](./resources/sample-queries) and [this blog post](https://y0nil.github.io/kusto.blog/blog-posts/jakh.html) were provided to help participants get inspired. 18 | 19 | For full details of the contest, see [official rules](./CONTEST_RULES.md). 20 | 21 | ## Important dates 22 | 23 | | Period | Starts | Ends | Status | 24 | |--------|------------------------------|-------------------------------|-----------| 25 | | Entry | April 1, 2025, 12:00 p.m. PT | April 30, 2025, 11:59 p.m. PT | Completed | 26 | | Voting | May 1, 2025, 12:00 p.m. PT | May 8, 2025, 12:00 p.m. PT | Completed | 27 | 28 | ## Queries 29 | 30 | ***177 Kusto hackers submitted 202 queries! 🚀*** 31 | 32 | 89 queries qualified to the voting stage - The participating queries can be found [here](./resources/participating-queries). 33 | 34 | Queries that didn't meet the following criteria were excluded: 35 | 36 | 1. Had an invalid link to a GitHub gist. 37 | 2. Were semantically or syntactically invalid. 38 | 3. Were not self-contained, and relied on an external data source or a custom tool. 39 | 4. Did not output the requested string (`"Just another Kusto hacker"`) in any way, shape, or form. 40 | 5. Produced an inconsistent output when run sequentially. 41 | 6. Were too trivial. E.g.,: 42 | - `print "Just another Kusto hacker"` 43 | - `print base64_decode_tostring(base64_encode_tostring("Just another Kusto hacker"))` 44 | - `print strcat("Just another", "Kusto hacker")` 45 | 46 | ## Categories 47 | 48 | Participating queries competed for votes in the following categories: 49 | 50 | 1. 🎭 **Most creative**: A query that showcases the most unique or unexpected approach to solving the problem in an obfuscated way. Creativity might involve innovative uses of query structures that are rarely used in typical queries. 51 | 52 | 2. 🤵 **Most elegant obfuscation**: A query that demonstrates elegance in its obfuscation, meaning that while the query is difficult to read, it does so in a sophisticated, intentional manner. Sometimes, simplicity (in terms of length or structure) can be elegant even if the query is complex to understand. 53 | 54 | 3. 😆 **Best humor**: A query that makes people laugh while still being functional and obfuscated might win this category. This could include humorous variable names, messages embedded in the query, or absurd logic that results in unexpected, amusing behavior. 55 | 56 | 4. 🤹‍♂️ **Best use of language features**: A query that utilizes unusual or advanced features of KQL to create the most obscure or unique result. 57 | 58 | 5. 🤏 **Best minimalism**: A query that achieves maximum obfuscation with the least amount of code might win in this category. 59 | 60 | 6. 😍 **People's choice**: The query that was liked the most. No special criteria, just the voters' personal preference. 61 | 62 | ## 🏆 And the winners are... 63 | 64 | | | Category | Author | Query | 65 | |-|----------------------------------|----------------------------------------------------|-----------------------------------------------------------| 66 | |1| 🏅 Most creative | [@LachyDeeW](https://github.com/LachyDeeW) | [query-88](./resources/participating-queries/query-88.md) | 67 | |2| 🏅 Most elegant obfuscation (a) | [@NeilMacMullen](https://github.com/NeilMacMullen) | [query-58](./resources/participating-queries/query-58.md) | 68 | |2| 🏅 Most elegant obfuscation (b) | [@KustoKing](https://github.com/KustoKing) | [query-61](./resources/participating-queries/query-61.md) | 69 | |3| 🏅 Best humor | [@LachyDeeW](https://github.com/LachyDeeW) | [query-88](./resources/participating-queries/query-88.md) | 70 | |4| 🏅 Best use of language features | [@myevo8u](https://github.com/myevo8u) | [query-83](./resources/participating-queries/query-83.md) | 71 | |5| 🏅 Best minimalism | [@razi-rais](https://github.com/razi-rais) | [query-01](./resources/participating-queries/query-01.md) | 72 | |6| 🏅 People's choice | [@LachyDeeW](https://github.com/LachyDeeW) | [query-88](./resources/participating-queries/query-88.md) | 73 | 74 | --- 75 | 76 | ## Contributing 77 | 78 | This project welcomes contributions and suggestions. Most contributions require you to agree to a 79 | Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us 80 | the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com. 81 | 82 | When you submit a pull request, a CLA bot will automatically determine whether you need to provide 83 | a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions 84 | provided by the bot. You will only need to do this once across all repos using our CLA. 85 | 86 | This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). 87 | For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or 88 | contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments. 89 | 90 | ## Trademarks 91 | 92 | This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft 93 | trademarks or logos is subject to and must follow 94 | [Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general). 95 | Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. 96 | Any use of third-party trademarks or logos are subject to those third-party's policies. 97 | -------------------------------------------------------------------------------- /resources/participating-queries/query-82.md: -------------------------------------------------------------------------------- 1 | [Click to run](https://dataexplorer.azure.com/clusters/help/databases/Samples?query=H4sIAAAAAAAEAO1WTW/jNhA9N7+C8CV24QCm811gUSRpF+uibS7B7iEIDEoaRawp0SCpeB30x/eRkh0mVoI47qmo82GbHL6ZeTPzxEw4/CSKWP+GvrtvQqmfmHVGVveDvdu9H3q3k8oZfceuiwPtf4csvPWG2NPFbsv+LWyFf7dfyVhi/I5NWG0pY04zUyMyVxBbaKOyYHZV1NXMYqFWGVNaZGxRUIUz9+JhbduY/qkXjB7ILFkl7wvnbTSSw6pYiGUw+SIzYrnRZThZ6sRG3q1qrZr4JhWIqUuqnFAMtJBRdUZ3GxmMm6WbgpZMVykCIoPIyBiZS2pC+zWE5WRJ8Ke0nsGjrOATYUjDaEk22H2VSol7wLYJpwWRYeWSrRL4rA0TrCCjAbQQdggE4fZhjzePttzPmG2NryvkKKva+ZhYAe6kYyh5wxbqj4rUpiGbJXQvKk9DvrK4gNOGLKwEP/68hwlpJpTqkp5y90apQcYs1yHmgtR8yJLaVwJl0JmPD9RUdZlELF4V2tS2IdGX9ZGYzvM1PSzRdZUpspbZ2VLJitpiI6tE6XQGkrQEY3OUD32Mg+GYrStbrKxvalMxYTzSkM0lDtVzH6L1zcNEha6S1HbcjfepREZNyiFXZJQiMXqQqukaxLZcn7jA+ULPETcIz0Caa4ohLWIT2noHwfAX8i2VOqkRI0KygaqQJDl0TFsYNAuKnKBxkUuxOnzjQVHy1QD4YQmUMrUyeXfPHrZ0N4AeIzVEc994nozA34wUOV01jXmpaMEyvWi4zbRuLRP9HUHUFpE2VBijFz5E+fjoi5EsmZIz8hpDAnOsc3zHcLbVdqFf1u01YWloez+MDjx6D/na/KKJFDUk9KDRomzz9+DU2HwWpVSSLEsMhgw1d77M+Wr7d5kTmtiSytEgdk7AynyQAkCIsKHxGlK1KJaBG+lWoeFbte+Yd/7zf6p9J3nTq4lwDvpri0ZryQssBAuy2BZ3wmYVmvIL1CfBIwOqIv3M+/IhmEq0anAZetn7cAKlF76W7+/hhtVLI7P7tnFfe4z8W+sdJcz+r+GrNbwIAvHOOl7X/jrR0K/1gX76e/fa3t3e3xh6r5k/4tPc6L8odWx1f8GSrctSGInJKxHsVEnrpjLvO93cbNZXncGw0q4vLZVzt3xaHQyeYA8MeQ7W6OwTC3CRt0V4iK0NUg2xlZDyXu+jv6K3hu1/9NURT9IbfPT1VpppL3Rr584zItHXaKGIOXyC4LLpCKwi7WiF+5Xf4pUxVvDZiNT1e3VvOBpulnPAniNgPxWuP+VDnPebq1j8/Q9LEfxhDG+3hz/chD+M4I9ieLc9/NEm/NHe6+ajQbR5HPsW2/s+3vR9HMGfxPDV9vAnm/AnEfxpDK+3hz/dhD+N4M92LMzZJvxZBH8ewxfbw59vwp/HdR/F+LQ9Ph9tOuCj2AOPPZgPeOAdHvh7e5f7sXe6nuMq2l+HMXsljDfj6BAAHisAP9xRYXiHBvBYBPjRjiLDO2SAP9OB4x3bmXcMO4+nnZ/sOI+8Y975ybv74XTHgeIdesBjQeBnO8ol75AEHmsCfyYK6Qc8dKgCj2Vh/EwWXpuWtx6WHbIwjmVhzHcUnnGHLIxjWRiPdxSecdcTf7z3cmn00ii6n7y8A+ISPf0mbTGd2Okfy+mVxjUTrj/B+T99vCWASRMAAA==) 2 | 3 | ```kql 4 | datatable (TextWall: string) 5 | [ 6 | "[Intro] Oh-oh-oh, oh-oh", 7 | "oh Oh-oh-oh, oh-oh", 8 | "oh Oh-oh-oh, oh-oh", 9 | "oh Oh-oh-oh, oh-oh, oh", 10 | "", 11 | "[Verse 1] I used to rule the world", 12 | "Chunks would load when I gave the word", 13 | "Now every night I go stow away", 14 | "Hide from the mobs I used to slay", 15 | "", 16 | "[Instrumental Interlude]", 17 | "", 18 | "[Verse 2]", 19 | "They once were terrified", 20 | "Every time I looked into their eyes", 21 | "Villagers would cheer my way", 22 | "For a hero I was, that's what they'd say", 23 | "One minute we had it all", 24 | "Next, our world began to fall", 25 | "Away from all that it had once become", 26 | "They all cried for my help, but I stood there numb", 27 | "", 28 | "[Chorus]", 29 | "I gaze off into the boundless skyline", 30 | "Note block choirs playing in the sunshine", 31 | "Turn around, pick up my sword and wield", 32 | "The blade that once forced evil mobs to yield", 33 | "And hope one day that this chaos and", 34 | "Destruction turns for the better", 35 | "Never a bow in hand", 36 | "That was when I ruled the land", 37 | "[Instrumental Interlude]", 38 | "", 39 | "[Verse 3]", 40 | "It was the creepers and the skeletons", 41 | "Blew down the doors and boxed us in", 42 | "Arrows whizzing by like streaks of light", 43 | "I tried all that I could to stay and fight", 44 | "As the undead roamed the street", 45 | "Families broken at my feet", 46 | "Life itself suspended by a thread", 47 | "Oh, why was it that I wasn't dead?", 48 | "", 49 | "[Chorus]", 50 | "I gaze off into the boundless skyline", 51 | "Note block choirs playing in the sunshine", 52 | "Turn around, pick up my sword and wield", 53 | "The blade that once forced evil mobs to yield", 54 | "If this battle should leave me slain", 55 | "I know Herobrine will call my name", 56 | "Better to take a stand", 57 | "That was when I ruled the land", 58 | "", 59 | "[Bridge]", 60 | "Oh-oh-oh, oh-oh, oh", 61 | "Oh-oh-oh, oh-oh, oh", 62 | "Oh-oh-oh, oh-oh, oh", 63 | "Oh-oh-oh, oh-oh, oh", 64 | "[Chorus]", 65 | "I gazed off into the boundless skyline", 66 | "Note block choirs playing in the sunshine", 67 | "Turn around, pick up my sword and wield", 68 | "The blade that once forced evil mobs to yield", 69 | "If this battle should leave me slain", 70 | "I know Herobrine will call my name", 71 | "Better to take a stand", 72 | "And that was when I ruled the land", 73 | "", 74 | "[Outro]", 75 | "Ooo-ooo-ooo-ooo", 76 | "Ooo-ooo-ooo-ooo", 77 | "Ooo-ooo-ooo-ooo" 78 | ] 79 | | union * 80 | | project TextWall 81 | | summarize make_list_if(tostring(TextWall),not(isempty(TextWall))) 82 | | project-rename TextWall = list_TextWall 83 | | where TextWall contains "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "a" 84 | | where (((((((((((((((((((((((((((((((((((((((((((((((((((((((((TextWall contains "b"))))))))))))))))))))))))))))))))))))))))))))))))))))))))) 85 | | where TextWall contains "c" and TextWall contains "c" 86 | | project-reorder TextWall 87 | | extend _0 = " " 88 | | extend _1 = "J" 89 | | extend _2 = extract("u",0,tostring(TextWall)) | extend _1 = strcat(_1, _2) | project-away _2 90 | | extend _3 = extract("s",0,tostring(TextWall)) | extend _1 = strcat(_1, _3) | project-away _3 91 | | extend _4 = extract("t",0,tostring(TextWall)) | extend _1 = strcat(_1, _4) | project-away _4 92 | | extend _1 = strcat(_1, _0) 93 | | extend _5 = extract("a",0,tostring(TextWall)) | extend _1 = strcat(_1, _5) | project-away _5 94 | | extend _6 = extract("n",0,tostring(TextWall)) | extend _1 = strcat(_1, _6) | project-away _6 95 | | extend _7 = extract("o",0,tostring(TextWall)) | extend _1 = strcat(_1, _7) | project-away _7 96 | | extend _8 = extract("t",0,tostring(TextWall)) | extend _1 = strcat(_1, _8) | project-away _8 97 | | extend _9 = extract("h",0,tostring(TextWall)) | extend _1 = strcat(_1, _9) | project-away _9 98 | | extend _10 = extract("e",0,tostring(TextWall)) | extend _1 = strcat(_1, _10) | project-away _10 99 | | extend _11 = extract("r",0,tostring(TextWall)) | extend _1 = strcat(_1, _11) | project-away _11 100 | | extend _1 = strcat(_1, _0) 101 | | extend _12 = toupper(extract("k",0,tostring(TextWall))) | extend _1 = strcat(_1, _12) | project-away _12 102 | | extend _13 = extract("u",0,tostring(TextWall)) | extend _1 = strcat(_1, _13) | project-away _13 103 | | extend _14 = extract("s",0,tostring(TextWall)) | extend _1 = strcat(_1, _14) | project-away _14 104 | | extend _15 = extract("t",0,tostring(TextWall)) | extend _1 = strcat(_1, _15) | project-away _15 105 | | extend _16 = extract("o",0,tostring(TextWall)) | extend _1 = strcat(_1, _16) | project-away _16 106 | | extend _1 = strcat(_1, _0) 107 | | extend _17 = extract("h",0,tostring(TextWall)) | extend _1 = strcat(_1, _17) | project-away _17 108 | | extend _18 = extract("a",0,tostring(TextWall)) | extend _1 = strcat(_1, _18) | project-away _18 109 | | extend _19 = extract("c",0,tostring(TextWall)) | extend _1 = strcat(_1, _19) | project-away _19 110 | | extend _20 = extract("k",0,tostring(TextWall)) | extend _1 = strcat(_1, _20) | project-away _20 111 | | extend _21 = extract("e",0,tostring(TextWall)) | extend _1 = strcat(_1, _21) | project-away _21 112 | | extend _22 = extract("r",0,tostring(TextWall)) | extend _1 = strcat(_1, _22) | project-away _22 113 | | project-away _0 | project-away TextWall 114 | | project-rename Thou_Wish_Is_My_Command = _1 115 | ``` --------------------------------------------------------------------------------