KQL vs. the Zombie Apocalypse: Surviving with Data Queries
Dive into a gritty tale of survival, where we’ll use KQL to analyze a dataset of survivor camps and zombie sightings to keep humanity one step ahead of the undead.
The world’s gone to hell. Zombies shuffle through the streets, and the only thing standing between you and a brain buffet is a laptop, a shaky Wi-Fi signal, and your trusty Kusto Query Language (KQL) skills. In this post-apocalyptic wasteland, data is your machete, and KQL is how you swing it. Let’s dive into a gritty tale of survival, where we’ll use KQL to analyze a dataset of survivor camps and zombie sightings to keep humanity one step ahead of the undead.
Download the Dataset for this blog post: https://github.com/rod-trent/KQL_Zombie_Apocalypse
The Setup: Our Post-Apocalyptic Dataset
Picture this: it’s 2025, and the zombie apocalypse has turned Earth into a dystopian yard sale. Survivors have banded together in camps, scraping by on canned beans and hope. Each camp logs its supplies, population, and zombie sightings in a central database (because even in the end times, someone’s still a data nerd). Our dataset, ApocalypseLogs
, contains three tables:
CampSupplies: Tracks food, water, and weapons per camp.
SurvivorCensus: Records camp populations and infection risks.
ZombieSightings: Logs zombie horde locations and sizes over time.
Here’s a peek at the schema:
Our mission? Use KQL to query this data and uncover insights to keep survivors alive. Let’s fire up our KQL engine and get to work.
Scenario 1: Finding Low-Supply Camps
The radio crackles: “Camp Delta’s eating dirt and drinking puddles!” Supplies are life, so we need to find camps running low on food or water. Let’s write a KQL query to spot camps with less than 10 units of food or 50 liters of water.
CampSupplies
| where FoodUnits < 10 or WaterLiters < 50
| project CampID, FoodUnits, WaterLiters
| order by FoodUnits asc
What’s happening here?
where
filters for camps with critically low supplies.project
selects only the columns we care about.order by
sorts results so we prioritize the hungriest camps.
Output (hypothetical):
Story Beat: Camp Delta’s down to half a can of Spam and a muddy bucket. We dispatch a supply run, but Bravo’s not much better off. Time to prioritize.
Scenario 2: Assessing Infection Risks
Zombies aren’t the only threat—internal infections can turn a camp into a buffet. Let’s query SurvivorCensus
to find camps with high infection rates (say, more than 5% of the population).
SurvivorCensus
| extend InfectionRate = (InfectedCount * 100.0) / Population
| where InfectionRate > 5
| project CampID, Population, InfectedCount, InfectionRate
| order by InfectionRate desc
What’s happening here?
extend
calculates the infection rate as a percentage.where
filters for camps above the 5% threshold.project
shows key metrics.order by
ranks camps by risk.
Output (hypothetical):
Story Beat: Camp Echo’s a ticking time bomb—10% infected! We radio in: “Quarantine now, or you’re all zombie chow!” Alpha’s not far behind, so we send medics with whatever passes for antibiotics these days.
Scenario 3: Predicting Zombie Migration with Time Series
Zombies don’t send RSVP’s, but their movements follow patterns. The ZombieSightings
table logs horde locations over time. Let’s use KQL’s time series capabilities to predict where the next horde might hit.
First, we aggregate sightings by day and region (assuming Latitude/Longitude map to grid zones):
ZombieSightings
| summarize TotalHordeSize = sum(HordeSize) by bin(Timestamp, 1d), Latitude, Longitude
| order by Timestamp asc
Now, let’s apply a time series analysis to detect trends in horde size near Camp Charlie (say, at Latitude 40, Longitude -74).
ZombieSightings
| where Latitude between(39..41) and Longitude between(-75..-73)
| make-series HordeTrend = sum(HordeSize) default=0 on Timestamp from ago(30d) to now() step 1d
| extend Forecast = series_decompose_forecast(HordeTrend, 7)
| project Timestamp, HordeTrend, Forecast
What’s happening here?
where
narrows sightings to Camp Charlie’s region.make-series
creates a time series of horde sizes over 30 days.series_decompose_forecast
predicts future horde sizes based on trends.project
outputs the trend and forecast.
Output (hypothetical):
Story Beat: The data screams trouble—horde sizes are spiking near Charlie. The forecast predicts a 170-zombie swarm tomorrow. We tell Charlie to board up and aim for the head.
Scenario 4: Joining Data for a Big Picture
One camp’s low on ammo, another’s got a zombie horde knocking. Let’s join CampSupplies
and ZombieSightings
to find camps that are both low on weapons and near recent sightings.
CampSupplies
| where WeaponsCount < 20
| join kind=inner (
ZombieSightings
| where Timestamp > ago(3d)
| summarize NearbyHordes = count() by Latitude, Longitude
) on $left.Latitude == $right.Latitude and $left.Longitude == $right.Longitude
| project CampID, WeaponsCount, NearbyHordes
What’s happening here?
where
filters for low-weapon camps and recent sightings.join
matches camps to nearby zombie activity.summarize
counts hordes per location.project
shows the danger zones.
Output (hypothetical):
Story Beat: Foxtrot’s got 15 bullets and three hordes circling like vultures. We scream into the radio: “Pack up and run, you glorious idiots!” They grab their gear and hightail it to a safer camp.
Why KQL Saves the Day
In the zombie apocalypse, KQL isn’t just a query language—it’s a survival tool. It’s fast, flexible, and lets you slice through data like a katana through undead flesh. Whether you’re rationing supplies, spotting infections, or predicting the next zombie wave, KQL turns raw logs into actionable intel.
Pro Tip: Keep your queries lean. The undead don’t wait for your laptop to chug through bad code. Practice with small datasets now, so when the hordes come, you’re ready to query and run.
Final Thoughts
The apocalypse is no place for guesswork. With KQL, you can turn a mess of survivor logs into a battle plan. Our queries helped Delta get food, Echo dodge an outbreak, Charlie brace for a horde, and Foxtrot escape certain doom. So, sharpen your KQL skills, keep your laptop charged, and maybe stash a crowbar nearby. The zombies are coming, but with data on your side, you just might outsmart them.
Stay querying, stay surviving.