Forum Discussion

Copper Contributor

Jan 29, 2020

Solved

KQL Syntax question

How do I rename the duration value from dependencies to seperate it from duration from requests. Query is as follows: let Client = union requests, dependencies | where cloud_RoleName contains...

Jan 31, 2020

Like this?

union isfuzzy=true 
(Dependencies 
| extend DurationA = Duration), 
(Requests
| extend DurationB = Duration)
| summarize  by DurationA, DurationB

Example using demo Tables

Go to Log Analytics and run query

union isfuzzy=true 
(Event 
| extend DurationA = EventID
| project DurationA
), 
(SecurityEvent
| extend DurationB = EventID
| project DurationB)
| summarize  count(DurationA), count(DurationB)

count_DurationA	count_DurationB
601533	601533

hspinto

Microsoft

Jan 30, 2020

Vincent20, I am not sure I understood your question nor the goal of your query. But if you want to rename a column, you have to use extend+project-away or simply project-rename.

For example

dependencies

| extend dependencyDuration = duration

| project-away duration

dependencies

| project-rename dependencyDuration = duration

Vincent20
Copper Contributor
Jan 30, 2020
Thank you for this. So the scenario is as follows: I have two tables Dependencies and Requests. Each of these have a column called Duration. So the query I have above merges columns in table 1(Dependencies) and table 2(requests) and combines all common columns in both as one. The problem is that I want to show all columns whether it is common or not, then rename the common column called duration so that I can Identify duration from dependencies and duration from requests. I look forward to your kind responsehspinto
- CliveWatson
  Former Employee
  Jan 31, 2020
  Vincent20
  
  Like this?
  
  union isfuzzy=true (Dependencies | extend DurationA = Duration), (Requests | extend DurationB = Duration) | summarize by DurationA, DurationB
  
  Example using demo Tables
  
  Go to Log Analytics and run query
  
  union isfuzzy=true (Event | extend DurationA = EventID | project DurationA ), (SecurityEvent | extend DurationB = EventID | project DurationB) | summarize count(DurationA), count(DurationB)
  
  count_DurationA count_DurationB
  
  601533 601533
  - Vincent20
    Copper Contributor
    Jan 31, 2020
    This is great. Exactly what I want to achieve.