KQL HELP Audit
This page is the exhaustive appendix for the docs refresh. It compares the current docs structure to the live KFDB HELP registry accessed during the audit.
Audit Method
The audit was grounded in live HELP output from the KFDB MCP server using:
HELP
HELP syntax
HELP clauses
HELP operators
HELP functions
HELP window_functions
HELP ai
HELP temporal
HELP examples
HELP schema
Coverage Matrix
| HELP bucket | Status | Notes |
|---|---|---|
syntax | Covered | Clause order, WITH, parameters, RETURN *, RETURN n.*, UNION added to KQL Syntax |
clauses | Covered | MATCH, OPTIONAL MATCH, WHERE, RETURN, WITH, ORDER BY, LIMIT, OFFSET, GROUP BY, HAVING, UNWIND, UNION, AT TIMESTAMP, HISTORY documented |
operators | Covered | Comparison, logical, string, null, list, arithmetic, vector similarity summarized in syntax page |
patterns | Partially covered | Core node/relationship patterns covered in narrative pages; complex pattern grammar still consolidated here rather than broken into its own page |
types | Covered in appendix | Value families called out below; existing docs do not need a dedicated page yet |
window_functions | Covered | ROW_NUMBER, RANK, DENSE_RANK, LAG, LEAD added to syntax page |
ai | Covered | AI.IF and AI.SIMILARITY now included in syntax page |
temporal | Covered | AT TIMESTAMP and HISTORY FROM ... TO ... added |
examples | Covered | Discovery, pattern, aggregation, conditional, EXISTS, list comprehension, multi-stage, UNION ALL, window, temporal, AI examples reflected |
schema | Covered | SHOW LABELS, SHOW EDGE_TYPES, SHOW PROPERTIES, SHOW SCHEMA promoted to first-class discovery workflow |
functions | Covered in appendix | Families and signatures summarized below |
Newly Surfaced Gaps That Were Missing Before
The older docs were materially missing or under-emphasizing:
WITHOPTIONAL MATCHUNION/UNION ALLUNWINDHAVINGRETURN *RETURN n.*- parameter syntax (
$param_name) SHOW LABELS,SHOW EDGE_TYPES,SHOW PROPERTIES,SHOW SCHEMA- temporal clauses (
AT TIMESTAMP,HISTORY) - AI expressions (
AI.IF,AI.SIMILARITY) - window functions
- most built-in function families beyond a small subset
Function Families from Live HELP
Graph
labels(node): arrayid(node): stringtype(relationship): stringproperties(node|edge): objectkeys(object): array
String
toString(value): stringtoUpper(string): stringtoLower(string): stringtrim(string): stringltrim(string): stringrtrim(string): stringleft(string, length): stringright(string, length): stringsubstring(string, start[, length]): stringreplace(string, search, replacement): stringsplit(string, delimiter): arrayreverse(string|array): string|array
Numeric
abs(number): numberceil(number): integerfloor(number): integerround(number[, precision]): numbersign(number): integersqrt(number): floatpow(base, exponent): floatexp(number): floatlog(number): floatlog10(number): floatsin,cos,tan,asin,acos,atan,atan2radians(degrees): floatdegrees(radians): floatpi(): floate(): floatrand(): float
Type conversion
toInteger(value): integertoFloat(value): floattoBoolean(value): boolean
List / size / collection
head(list): anytail(list): arraylast(list): anyrange(start, end[, step]): arraysize(list|string): integerlength(string|array): integerany(list): booleanall(list): booleannone(list): booleansingle(list): boolean
Null helpers
coalesce(expr1, expr2, ...): anyisNull(value): booleanisNotNull(value): boolean
Full-text search
search(text, query[, options]): objectmatch(text, pattern): booleanhighlight(text, query): stringsnippet(text, query[, length]): stringscore(text, query): float
Vector
vector(array): vectorcosine_similarity(vec1, vec2): floateuclidean_distance(vec1, vec2): floatdot_product(vec1, vec2): float
Path
shortestPath(start, end): pathshortestPathLength(start, end): integer
Aggregate
COUNT(expr): integerSUM(expr): numberAVG(expr): floatMIN(expr): anyMAX(expr): anyCOLLECT(expr): array
Temporal
timestamp(): integer
Window Functions from Live HELP
ROW_NUMBER() OVER ([PARTITION BY expr] ORDER BY expr)RANK() OVER ([PARTITION BY expr] ORDER BY expr)DENSE_RANK() OVER ([PARTITION BY expr] ORDER BY expr)LAG(expr[, offset[, default]]) OVER ([PARTITION BY expr] ORDER BY expr)LEAD(expr[, offset[, default]]) OVER ([PARTITION BY expr] ORDER BY expr)
AI Expressions from Live HELP
AI.IF(prompt => <expression>, model => <string>)AI.SIMILARITY(expr1, expr2)
Schema / Discovery Commands from Live HELP
SHOW LABELSSHOW EDGE_TYPESSHOW PROPERTIESSHOW PROPERTIES <Label>SHOW SCHEMA
Recommended discovery order:
SHOW LABELS
SHOW PROPERTIES File
SHOW EDGE_TYPES
SHOW SCHEMA
Remaining Documentation Debt
The audit is now materially complete, but a few deeper expansions are still optional future work rather than blockers:
- dedicated page for pattern grammar details
- dedicated page for built-in function cookbook examples
- dedicated page for temporal/query-history caveats and retention behavior
- dedicated page for AI-expression guardrails and cost guidance