Fabric RTI 101: KQL Joins and Lookups

Like SQL, KQL supports joins that let you combine data from multiple tables. This is a powerful way to bring together different data sources — for example, matching real-time events with reference or lookup data to give them more context.

The join operator works much like you’d expect, combining rows based on a matching key. KQL supports several join types, including inner, leftouter, rightouter, and fullouter.

Here’s a simple example:

Events
| join kind=inner DeviceInfo on DeviceId

This query takes the Events table and joins it with DeviceInfo where the DeviceId matches in both. The result is a single dataset that includes columns from both tables.

In practice, you’ll often use joins to enrich streaming or telemetry data with static information — for instance, adding location or configuration details to an incoming stream of sensor events.

There’s also a simplified version of join called lookup, which is perfect for quick dimension-style enrichment. Instead of specifying a full join, lookup assumes a leftouter join pattern — it looks up matching rows from a smaller, reference dataset and appends the relevant fields. It’s easier to write and ideal for lightweight lookups.

For example:

Events
| lookup kind=leftouter DeviceInfo on DeviceId

That adds fields from DeviceInfo where there’s a matching DeviceId, and leaves the others unchanged.

Together, join and lookup are what enable context-aware real-time analytics — letting you go beyond raw telemetry to include business or environmental context. Instead of just seeing that Device 123 failed, you can instantly know that it’s a temperature sensor in Melbourne, running firmware version 5.2.

That context turns raw events into meaningful insight — which is exactly what KQL is designed to do.

Learn more about Fabric RTI

If you really want to learn about RTI right now, we have an online on-demand course that you can enrol in, right now. You’ll find it at Mastering Microsoft Fabric Real-Time Intelligence

2026-06-18