How to filter data with the where operator in KQL

The where operator is the most common way to filter data in KQL: it keeps only the rows that meet a condition and drops the rest. Because Real-Time Analytics tables grow every second, a good filter is the difference between a fast query and one that needlessly scans millions of records. Below you'll find practical examples with numbers, text and dates.

Prerequisites

• A KQL database in Microsoft Fabric (Real-Time Intelligence) or in Azure Data Explorer.
• A table with data to query. The examples use a Telemetria table with the columns Timestamp, SensorId, Regiao and Temperatura.
• Basic knowledge of how to open a KQL Queryset and run a query.

Step 1: Filter by a numeric value

Start with the simplest case: show only the readings where the temperature goes above 30 degrees. Write the table name, the pipe |, and the condition after where.

Telemetria
| where Temperatura > 30

The result has exactly the same columns as the original table, but only the rows where the condition is true. You can use the operators >, >=, <, <=, == (equal) and != (not equal).

Step 2: Combine several conditions

To apply more than one criterion at once, join the conditions with and (all must be true) or or (only one needs to be). This lets you, for example, isolate the high temperatures of a single region.

Telemetria
| where Temperatura > 30 and Regiao == "Norte"

You can chain several where statements in a row — the effect is the same as using and, and it is often more readable.

Telemetria
| where Temperatura > 30
| where Regiao == "Norte"

Step 3: Filter text (has, contains and startswith)

When filtering text columns, the operator you choose affects performance. The has operator looks for whole words and uses the term index, so it is fast. The contains operator looks for any piece of text (a substring); it is more flexible but slower, because it scans every value.

Telemetria
| where SensorId has "porta"
| where Regiao startswith "N"

Best practice: prefer has whenever you are looking for a complete word; keep contains for when you really need part of a word. Mind the case: == is case-sensitive, while =~ and has itself ignore case.

Step 4: Filter by date and time

In Real-Time Analytics it is very common to want only the most recent data. The ago() function refers to a period counting back from now — ago(1h) means "one hour ago".

Telemetria
| where Timestamp > ago(1h)

For a fixed range, use between with two dates. The .. operator separates the start from the end.

Telemetria
| where Timestamp between (datetime(2026-07-01) .. datetime(2026-07-05))

Step 5: Filter early to gain speed

Order matters. Put where as early as possible in the query, before join, summarize or sort. By reducing the number of rows right away, every later operation works over less data and the query runs faster.

Telemetria
| where Timestamp > ago(24h) and Temperatura > 30
| summarize Leituras = count() by Regiao

Check the result

To confirm the filter worked, count the rows before and after. First run the table with just | count, then with your where followed by | count: the second number should be smaller. You can also use | take 10 to see a sample and confirm every row meets the condition you set.

Telemetria
| where Temperatura > 30
| count

Conclusion

You now know how to filter data in KQL by numbers, text and dates, and why order and the choice between has and contains make a difference. The natural next step is to combine where with summarize to aggregate the filtered data, or with render to visualize it in a chart. What is the first filter you need to apply to your telemetry data?