Azure Data Explorer - Useful utility functions

ResultsToMarkdown.kql

.create-or-alter function with (folder = "formatting", docstring = "Table to Markdown", skipvalidation = "true") TableToMarkdown(t:(*)) {
let schema = t | getschema;
let headers = schema | project ColumnName | summarize make_list(ColumnName) | extend String = strcat('| ', strcat_array(list_ColumnName, ' | '), ' |') | project String, Order=1;
let upperDivider = schema | project ColumnName, Sep = '---' | summarize Cols=make_list(Sep) | extend String = strcat('| ', strcat_array(Cols, ' | '), ' |') | project String, Order=2;
let data = t | extend Cols=pack_array(*) | extend String = strcat('| ', strcat_array(Cols, ' | '), ' |') | project String, Order=3;
headers 
| union upperDivider
| union data
| order by Order asc 
| summarize Rows=make_list(String) 
| project array_strcat(Rows, '\r\n')
} 

TimeManipulation.kql

.create-or-alter function with (folder = "timeutils", docstring = "Start of hour", skipvalidation = "true") startofhour(dt:datetime ) {
    make_datetime(datetime_part('Year', dt), datetime_part('Month', dt), datetime_part('Day', dt), datetime_part('Hour', dt), 0, 0)
} 

.create-or-alter function with (folder = "timeutils", docstring = "Start of hour", skipvalidation = "true") endofhour(dt:datetime ) {
    make_datetime(datetime_part('Year', dt), datetime_part('Month', dt), datetime_part('Day', dt), datetime_part('Hour', dt), 59, 59)
}