Forum Discussion
Solved
KQL Syntax question
How do I rename the duration value from dependencies to seperate it from duration from requests. Query is as follows: let Client = union requests, dependencies | where cloud_RoleName contains...
Like this?
union isfuzzy=true (Dependencies | extend DurationA = Duration), (Requests | extend DurationB = Duration) | summarize by DurationA, DurationBExample using demo Tables
Go to Log Analytics and run query
union isfuzzy=true (Event | extend DurationA = EventID | project DurationA ), (SecurityEvent | extend DurationB = EventID | project DurationB) | summarize count(DurationA), count(DurationB)count_DurationA count_DurationB 601533 601533
Thank you for this. So the scenario is as follows: I have two tables Dependencies and Requests. Each of these have a column called Duration. So the query I have above merges columns in table 1(Dependencies) and table 2(requests) and combines all common columns in both as one. The problem is that I want to show all columns whether it is common or not, then rename the common column called duration so that I can Identify duration from dependencies and duration from requests. I look forward to your kind responsehspinto
Like this?
union isfuzzy=true
(Dependencies
| extend DurationA = Duration),
(Requests
| extend DurationB = Duration)
| summarize by DurationA, DurationB
Example using demo Tables
Go to Log Analytics and run query
union isfuzzy=true
(Event
| extend DurationA = EventID
| project DurationA
),
(SecurityEvent
| extend DurationB = EventID
| project DurationB)
| summarize count(DurationA), count(DurationB)
| count_DurationA | count_DurationB |
|---|---|
| 601533 | 601533 |
- This is great. Exactly what I want to achieve.