msticpy.data.sql_to_kql module

Module for SQL to KQL Conversion.

This is an experiment conversion utility built to support a limited subset of ANSI SQL.

It relies on mo_sql_parsing https://github.com/klahnakoski/mo-sql-parsing (a maintained fork from the deprecated https://github.com/mozilla/moz-sql-parser) to parse the SQL syntax tree. Some hacky additions have been done to allow table renaming and support for non ANSI SQL operators such as RLIKE.

For a more complete translation help with SQL to KQL see https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/sqlcheatsheet

Known limitations

• Does not support aggregate functions in SELECT with no GROUP BY clause

• Does not support IN, EXISTS, HAVING operators

• Only partial support for AS naming (should work in SELECT expressions)

class msticpy.data.sql_to_kql.FuncFormat(default, cust_arg_fmt, cust_func_format)

Bases: tuple

Create new instance of FuncFormat(default, cust_arg_fmt, cust_func_format)

count(value, /)

Return number of occurrences of value.

cust_arg_fmt

Alias for field number 1

cust_func_format

Alias for field number 2

default

Alias for field number 0

index(value, start=0, stop=9223372036854775807, /)

Return first index of value.

Raises ValueError if the value is not present.

msticpy.data.sql_to_kql.sql_to_kql(sql: str, target_tables: Dict[str, str] | None = None) → str

Parse SQL and return KQL equivalent.