Forum Discussion
KQL Syntax question
How do I rename the duration value from dependencies to seperate it from duration from requests.
Query is as follows:
let Client = union requests, dependencies
| where cloud_RoleName contains 'EUWPGTP018WAP04' or target contains 'client';
Client
| project operation_Name, operation_ParentId, operation_Id, duration
| join (Client | where operation_ParentId contains operation_Id)
on operation_Id
Like this?
union isfuzzy=true (Dependencies | extend DurationA = Duration), (Requests | extend DurationB = Duration) | summarize by DurationA, DurationBExample using demo Tables
Go to Log Analytics and run query
union isfuzzy=true (Event | extend DurationA = EventID | project DurationA ), (SecurityEvent | extend DurationB = EventID | project DurationB) | summarize count(DurationA), count(DurationB)count_DurationA count_DurationB 601533 601533
4 Replies
- hspinto
Microsoft
Vincent20, I am not sure I understood your question nor the goal of your query. But if you want to rename a column, you have to use extend+project-away or simply project-rename.
For example
dependencies| extend dependencyDuration = duration| project-away durationordependencies| project-rename dependencyDuration = durationThank you for this. So the scenario is as follows: I have two tables Dependencies and Requests. Each of these have a column called Duration. So the query I have above merges columns in table 1(Dependencies) and table 2(requests) and combines all common columns in both as one. The problem is that I want to show all columns whether it is common or not, then rename the common column called duration so that I can Identify duration from dependencies and duration from requests. I look forward to your kind responsehspinto
Like this?
union isfuzzy=true (Dependencies | extend DurationA = Duration), (Requests | extend DurationB = Duration) | summarize by DurationA, DurationBExample using demo Tables
Go to Log Analytics and run query
union isfuzzy=true (Event | extend DurationA = EventID | project DurationA ), (SecurityEvent | extend DurationB = EventID | project DurationB) | summarize count(DurationA), count(DurationB)count_DurationA count_DurationB 601533 601533
