Which KQL keyword is used to group and aggregate data?

• A. Group_By
• B. Aggregate
• C. Summarize
• D. Count

Answer: (C)

Summarize is the keyword in KQL used to group data and compute aggregates. It lets you define grouping keys with a by clause and specify aggregations like sum(), avg(), count(), and more to run for each group. For example, you can group by a time bucket and measure totals with: summarize sum(bytes) by bin(Timestamp, 1h). This returns a result for each hour with the total bytes in that hour.

Other options don’t fit because there isn’t a Group_By keyword in KQL, and Aggregate isn’t a standalone keyword. Count is an aggregation function that can be used inside summarize, but by itself it doesn’t perform the grouping.