In this article, we learn on how to use Extend Operator in Kusto Query Language (KQL) , Just follow and ready clearly.

For more updates please do Subscribe via Email:

What is Kusto Query Language (KQL)

Kusto is a query language designed for big data workloads particularly using large amount of data in from things like logs and event sources. Kusto  query is a read-only request to process data and return results. KQL is the first party query language for Kusto cluster used by Azure Data Explorer. Kusto Query is only good for pulling or getting data from the data bank. for more article about Kusto. Please refer this link.

Kusto Query Language (KQL)

Extend Operator

Extend will create calculated columns and append them to the result sets.

A copy of the input tabular result set, such that:

  • Column names noted by extend that already exist in the input are removed and appended as their new calculated values.
  • Column names noted by extend that do not exist in the input are appended as their new calculated values.
  • The extend operator adds a new column to the input result set, which does not have an index. In most cases, if the new column is set to be exactly the same as an existing table column that has an index, Kusto can automatically use the existing index. However, in some complex scenarios this propagation is not done. In such cases, if the goal is to rename a column, use the project-rename operator instead.


| extend
    Duration = CreatedOn - CompletedOn
    , Age = now() - CreatedOn
    , IsSevere = Level == "Critical" or Level == "Error"

Happy Learning..

Thank you for visiting my blog site. Hoping you learn more here. please feel free to comment and suggest if there is need to enhance and update. thank you.

Related Topics

Leave a Reply

Your email address will not be published. Required fields are marked *