Section 9: One Door, Three Tiers - Deep Dive: Query Layer
Executive Summary: Section 8's storage deep dive left the data in three places with three cost profiles: ADX for 30 days, the Parquet lake for a year, and Blob Archive for seven years of P0. This section puts one KQL endpoint in front of all three. The router binds the tenant from the token, injects a predicate no query can remove, and routes by time range: ≤ 30 days runs interactively on ADX, 31–365 days becomes an async search job over the lake, and older P0 data a restore job. We trace the Contoso analyst's 09:16 query to its 1.8-second answer, then govern about 4,000 queries a second.
The interviewer taps the three storage boxes. "Your customers don't want three systems. They want a search box. What sits behind it?"
Who Is Knocking
The callers want different things:
| Caller | Load | What it needs |
|---|---|---|
| Interactive analysts | 20,000 concurrent, ≈ 667 qps | Answers in seconds, iteratively, mostly over the last 24 h |
| Scheduled queries (analytics rules, dashboards) | 1M every 5 min, ≈ 3,333 qps | To run on time, every time |
| APIs and exports | Small | Large result sets; latency matters less |
| Search jobs and restores | Rare | Months or years of data, in minutes to hours |
That's about 4,000 qps on average and 8,000 at peak, or about 67 qps per stamp. Scheduled queries outnumber humans five to one.
Sign in to continue reading
The rest of this lesson is available with a free account. Signing in with Google or Microsoft is free.
Sign in to read the full lesson