# KQL Queryset definition

This article provides a breakdown of the structure for KQL Queryset (Real-Time Queryset) definition items.

## Definition parts

This table lists the KQL Queryset definition parts.

| Definition part path | type | Required | Description |
|--|--|--|--|
| `RealTimeQueryset.json` | RealTimeQueryset (JSON) | true | Describes the content of the payload. |
| `.platform` | PlatformDetails (JSON) | false | Describes common details of the item |

## Definition example

```json
{
  "parts": [
    {
      "path": "RealTimeQueryset.json",
      "payload": " ",
      "payloadType": "InlineBase64"
    },
    {
      "path": ".platform",
      "payload": "ZG90UGxhdGZvcm1CYXNlNjRTdHJpbmc=",
      "payloadType": "InlineBase64"
    }
  ]
}
```

## RealTimeQueryset

The `payload` property contains the content of the definition, which is Base64-encoded. The content is a JSON object that describes the Queryset. The JSON object contains a root object called `queryset`, which has several properties that define the Queryset.

### Queryset properties

Describes the fields used to construct the `Queryset` object.

| Definition part path | type | Required | Description |
|--|--|--|--|
| `version` | string | true | The version of the Queryset. |
| `dataSources` | DataSource (Array) | true | The list of data sources used in the Queryset. |
| `tabs` | Tab (Array) | true | The list of tabs in the Queryset. |

### DataSource

Describes the fields used to construct the `DataSource` object.

| Definition part path | type | Required | Description |
|--|--|--|--|
| `id` | string | true | The unique identifier for the data source. |
| `clusterUri` | string | true | The URI of the data source. |
| `type` | string | true | The type of the data source. Valid values: `AzureDataExplorer` |
| `databaseName` | string | true | The name of the database in the data source. |

### Tab

Describes the fields used to construct the `Tab` object.

| Definition part path | type | Required | Description |
|--|--|--|--|
| `id` | string | true | The unique identifier for the tab. |
| `content` | string | true | The content of the tab, which is a KQL query. |
| `title` | string | true | The title of the tab. |
| `dataSourceId` | string | true | The unique identifier of the data source used in the tab. |

## RealTimeQueryset example

The following example payload is a JSON object that describes a Queryset containing a single tab with the query `StormEvents | count`.

This example shows the decoded JSON object for the `RealTimeQueryset` payload.

```json
{
  "queryset": {
    "version": "1.0.0",
    "dataSources": [
      {
        "id": "c2434bf8-25bb-4aa0-8746-db470533adaf",
        "clusterUri": "https://help.kusto.windows.net/",
        "type": "AzureDataExplorer",
        "databaseName": "Samples"
      }
    ],
    "tabs": [
      {
        "id": "ccd7b90c-51fe-429f-a853-385b02bd74c9",
        "content": "StormEvents\\\\n| count",
        "title": "Tab1Name",
        "dataSourceId": "c2434bf8-25bb-4aa0-8746-db470533adaf"
      }
    ]
  }
}
```
