How to use extend operator in Kusto Query Language (KQL)

In this article, we learn on how to use Extend Operator in Kusto Query Language (KQL) , Just follow and ready clearly.

For more updates please do Subscribe via Email:

Table Of Contents

What is Kusto Query Language (KQL)
Extend Operator
Example
Related Topics

What is Kusto Query Language (KQL)

Kusto is a query language designed for big data workloads particularly using large amount of data in from things like logs and event sources. Kusto query is a read-only request to process data and return results. KQL is the first party query language for Kusto cluster used by Azure Data Explorer. Kusto Query is only good for pulling or getting data from the data bank. for more article about Kusto. Please refer this link.

Extend Operator

Extend will create calculated columns and append them to the result sets.

A copy of the input tabular result set, such that:

Column names noted by extend that already exist in the input are removed and appended as their new calculated values.
Column names noted by extend that do not exist in the input are appended as their new calculated values.

The extend operator adds a new column to the input result set, which does not have an index. In most cases, if the new column is set to be exactly the same as an existing table column that has an index, Kusto can automatically use the existing index. However, in some complex scenarios this propagation is not done. In such cases, if the goal is to rename a column, use the project-rename operator instead.

Example

table
| extend
    Duration = CreatedOn - CompletedOn
    , Age = now() - CreatedOn
    , IsSevere = Level == "Critical" or Level == "Error"

Happy Learning..

Thank you for visiting my blog site. Hoping you learn more here. please feel free to comment and suggest if there is need to enhance and update. thank you.