How to Generate KQL Queries with Copilot in Fabric

João Barros 06 de July de 2026 4 min read

Writing KQL (Kusto Query Language) queries from scratch can feel intimidating when you are new to real-time data analysis. Copilot in Fabric fixes that: you describe your question in natural language and it generates the KQL query for you, right inside the Real-Time Intelligence experience — perfect for exploring data without memorizing syntax.

Prerequisites

A paid Fabric capacity (F2 or higher) with Copilot enabled by your tenant administrator.
A workspace assigned to that capacity.
An Eventhouse with a KQL database that already contains data (you can use sample data).
Permission to create items, such as a KQL Queryset, in that workspace.

Step 1: Open the Eventhouse in Real-Time Intelligence

In the Fabric portal, switch to the Real-Time Intelligence experience using the selector at the bottom left. Open your workspace and click the Eventhouse that holds the KQL database with your data. Make sure you can see at least one table with rows in the side tree — that is the table you will ask about. In this example we will use a table named Readings with device readings.

Step 2: Create a KQL Queryset

Inside the Eventhouse, click New related item and choose KQL Queryset (alternatively, use the workspace + New button). Give it a name, for example consultas-copilot, and connect it to the Eventhouse KQL database. This editor is where you will write — or let Copilot write — your queries.

Step 3: Open the Copilot pane

On the KQL Queryset ribbon, click the Copilot button. A pane opens on the right with a text box. On first use, Copilot shows suggested questions based on the available tables. This step only works well if the database has data: Copilot reads the schema (table and column names) to generate correct KQL tailored to your model.

Step 4: Write your question in natural language

In the Copilot box, type a clear, specific question. The more concrete you are — naming the table, the time window and the metric — the better the result. For example:

Show the top 5 devices with the most readings in the last hour, from the Readings table.

When you press Enter, after a few seconds Copilot returns a KQL query similar to this:

Readings
| where Timestamp > ago(1h)
| summarize TotalReadings = count() by DeviceId
| top 5 by TotalReadings desc

Notice how each KQL line maps to part of your question: the time filter with ago(1h), the aggregation with summarize and the five-result limit with top 5. This mapping helps you learn the language while you work.

Step 5: Insert and run the query

In the Copilot pane you get three options for the generated query: Copy, Insert and Replace. Click Insert to place the KQL in the editor. Then select the query and click Run (or press Shift+Enter). The results appear in the grid below, ready to analyze.

Step 6: Refine with follow-up prompts

The first version is rarely perfect, and that is fine. Copilot keeps the conversation context, so you can ask for adjustments in natural language, for example:

Now also group by the DeviceType column and sort by the total in descending order.

Copilot rewrites the query with the new conditions. If the answer is ambiguous or returns an error, be more explicit: state the exact table and column names to remove any doubt.

Verify the result

To confirm the query does what you wanted, run it and check three things: whether the grid returns the expected number of rows (here, at most five), whether the column names match what you asked for (DeviceId and TotalReadings) and whether the values make sense. As a quick test, run Readings | count to see the table's total row count and confirm the time filter is really reducing the data.

Conclusion

In just a few clicks you turned a plain-language question into a working KQL query, without memorizing syntax. The natural next step is to Pin the result to a Real-Time Dashboard, where Copilot also helps you build tiles from natural language. Try it now: what is the first question about your data that you will ask Copilot to answer?