Operations management

Kusto maintains an internal log of running and historic operations that it processes, such as ingestion operations and data management operations. Entries are appended to the log when operations start and change their state, including when operations reach their terminal state. Users can view the ongoing and past operations they started by using the .show operations control command. Database administrators can view all operations that apply to the databases they administer.

Users can also view the results of an operation by using the .show operation details command. Normally, the results are returned as part of .show operations command itself. For asynchronous control commands, the .show operation details command is the only way to view the command's results.

.show operations

The .show operations command returns a table with all administrative operations, both running and completed, which were executed in the last two weeks. The command may run in two "modes":

  • Log mode: In this mode, all entries in the log that the user has access to are returned. Multiple records might be returned for a single operation. Up to one record indicates the terminal state of Completed or Failed. This mode is used when the command doesn't indicate the operation ID(s).

  • Latest update mode: In this mode, the latest updated record for each operation ID provided by the user is returned. This mode is used when the command indicates which operation ID(s) to inspect.

Syntax

Syntax option Description
.show operations Returns all operations that the cluster is processing or operations the cluster has processed
.show operations OperationId Returns operation status for a specific ID
.show operations (OperationId1, OperationId2, ...) Returns operations status for specific IDs

Results

Output parameter Type Description
OperationId String Operation Identifier
Operation String Admin command alias
NodeId String If the command has a remote execution (for example, DataIngestPull) - NodeId will contain the ID of the executing remote node
StartedOn DateTime Date/time (in UTC) when the operation started
LastUpdatedOn DateTime Date/time (in UTC) when the operation last updated (can be either a step inside the operation, or a completion step)
Duration DateTime TimeSpan between LastUpdateOn and StartedOn
State String Command state, as listed in the State table
Status String Additional help string that contains errors of failed operations

State table

The following table describes the possible values for the result table's State column:

Value Description
InProgress The operation is still running
Completed The operation completed (successfully)
Failed The operation completed (unsuccessfully)
PartiallySucceeded The operation completed (parts of it successfully and part of it not)
Abandoned The operation was abandoned before completion
BadInput The operation didn't start executing as there was bad input
Scheduled The operation is scheduled for execution
Throttled The operation has been aborted due to throttling
Canceled The operation has been canceled by the user
Skipped The operation was skipped (due to some logical condition provided as the operation input)

Example

ID Operation Node ID Started On Last Updated On Duration State Status
3827def6-0773-4f2a-859e-c02cf395deaf SchemaShow 2015-01-06 08:47:01.0000000 2015-01-06 08:47:01.0000000 0001-01-01 00:00:00.0000000 Completed
841fafa4-076a-4cba-9300-4836da0d9c75 DataIngestPull Kusto.Azure.Svc_IN_1 2015-01-06 08:47:02.0000000 2015-01-06 08:48:19.0000000 0001-01-01 00:01:17.0000000 Completed
e198c519-5263-4629-a158-8d68f7a1022f OperationsShow 2015-01-06 08:47:18.0000000 2015-01-06 08:47:18.0000000 0001-01-01 00:00:00.0000000 Completed
a9f287a1-f3e6-4154-ad18-b86438da0929 ExtentsDrop 2015-01-11 08:41:01.0000000 0001-01-01 00:00:00.0000000 0001-01-01 00:00:00.0000000 InProgress
9edb3ecc-f4b4-4738-87e1-648eed2bd998 DataIngestPull 2015-01-10 14:57:41.0000000 2015-01-10 14:57:41.0000000 0001-01-01 00:00:00.0000000 Failed Collection was modified. Enumeration operation may not execute.

.show operation details

Operations can (optionally) persist their results, and the results can be retrieved when the operation is complete, using .show operation details.

Note

Not all control commands persist their results. Those commands that do, usually do so by default on asynchronous executions only, using the async keyword. See the documentation for the specific command and check if it does. For example, see data export). The output schema of the .show operations details command is the same schema returned from the synchronous execution of the command. The .show operation details command can only be invoked after the operation completed successfully. Use the show operations command) to check the state of the operation, before running this command.

Syntax

.show operation OperationId details

Results

The result is different per type of operation, and matches the schema of the operation result, when executed synchronously.

Examples

The OperationId in the example, returns from an asynchronous execution of one of the data export commands.

.export 
  async 
  to csv ( 
    h@"https://storage1.blob.core.windows.net/containerName;secretKey", 
    h@"https://storage1.blob.core.windows.net/containerName2;secretKey" 
  ) 
  <| myLogs 

The async export command returned the following operation ID:

OperationId
56e51622-eb49-4d1a-b896-06a03178efcd

This operation ID can be used when the command has completed to query the exported blobs.

.show operation 56e51622-eb49-4d1a-b896-06a03178efcd details 
Path NumRecords
http://storage1.blob.core.windows.net/containerName/1_d08afcae2f044c1092b279412dcb571b.csv 10
http://storage1.blob.core.windows.net/containerName/2_454c0f1359e24795b6529da8a0101330.csv 15