So you are new to Microsoft Sentinel and KQL and just getting familiar with the data you are ingesting. You want to write a few queries but in a reference and easy to read way want to lookup the data and values in it. You think back to PowerShell and remember the ability to format a list using | FL
In Microsoft Sentinel and in KQL language you can do something similar, to start with find a data table like SignInLogs or OfficeActivity or any data table name you are ingestion and use the following KQL query:
SigninLogs // <- Datatable name here
| take 1 // return results a single example
| evaluate narrow() // format result as a list
Shift + Enter to execute the log search and you now have a nice formatted list of the schema and values to understand each column further with a bit more context on how you might use | where or | summarize or other KQL commands.
You can use the results as a reference guide now while working on your query, using a new log search or browser tab or even better using a new browser window in 2nd monitor or snapped to your recommended side.
Now we are living like we were in the Days of Thunder…