Partial query failures

• 1: Kusto query result set exceeds internal limit
• 2: Overflows
• 3: Runaway queries

1 - Kusto query result set exceeds internal limit

A query result set has exceeded the internal … limit is a kind of partial query failure that happens when the query’s result has exceeded one of two limits:

• A limit on the number of records (record count limit, set by default to 500,000)
• A limit on the total amount of data (data size limit, set by default to 67,108,864 (64MB))

There are several possible courses of action:

• Change the query to consume fewer resources. For example, you can:
  • Limit the number of records returned by the query using the take operator or adding additional where clauses.
  • Try to reduce the number of columns returned by the query. Use the project operator, the project-away operator, or the project-keep operator.
  • Use the summarize operator to get aggregated data
• Increase the relevant query limit temporarily for that query. For more information, see Result truncation under query limits.

[!NOTE] We don’t recommend that you increase the query limit, since the limits exist to protect the database. The limits make sure that a single query doesn’t disrupt concurrent queries running on the database.

2 - Overflows

An overflow occurs when the result of a computation is too large for the destination type. The overflow usually leads to a partial query failure.

For example, the following query will result in an overflow.

let Weight = 92233720368547758;
range x from 1 to 3 step 1
| summarize percentilesw(x, Weight * 100, 50)

Kusto’s percentilesw() implementation accumulates the Weight expression for values that are “close enough”. In this case, the accumulation triggers an overflow because it doesn’t fit into a signed 64-bit integer.

Usually, overflows are a result of a “bug” in the query, since Kusto uses 64-bit types for arithmetic computations. The best course of action is to look at the error message, and identify the function or aggregation that triggered the overflow. Make sure the input arguments evaluate to values that make sense.

3 - Runaway queries

A runaway query is a kind of partial query failure that happens when some internal query limit was exceeded during query execution.

For example, the following error may be reported: HashJoin operator has exceeded the memory budget during evaluation. Results may be incorrect or incomplete.

There are several possible courses of action.

• Change the query to consume fewer resources. For example, if the error indicates that the query result set is too large, you can:
  • Limit the number of records returned by the query by
    • Using the take operator
    • Adding additional where clauses
  • Reduce the number of columns returned by the query by
    • Using the project operator
    • Using the project-away operator
    • Using the project-keep operator
  • Use the summarize operator to get aggregated data.
• Increase the relevant query limit temporarily for that query. For more information, see query limits - limit on memory per iterator. This method, however, isn’t recommended. The limits exist to protect the cluster and to make sure that a single query doesn’t disrupt concurrent queries running on the cluster.
• Increase the relevant query limit temporarily for that query. For more information, see query limits - limit on memory per iterator. This method, however, isn’t recommended. The limits exist to protect the Eventhouse and to make sure that a single query doesn’t disrupt concurrent queries running on the Eventhouse.