Forum Discussion

WillAda's avatar
WillAda
Copper Contributor
Nov 03, 2021

Kusto Combine to then Join

Is it possible to output 2 tables to then use in another join with a different query? For example say I have this
let de1=
DeviceNetworkEvents
| where DeviceName contains "server1"
| where ProcessId == "111";
let de2=
DeviceNetworkEvents
| where DeviceName contains "server1"
| where ConnectionString == "Connection Successful";
de1 | union de2 by Something

Can I then take the combined output of this and use the details from this to then do another union with a different table?
  • AnuragSrivastava's avatar
    AnuragSrivastava
    Iron Contributor
    Nov 24, 2021
    WillAda you can use the join operator.
    DeviceNetworkEvents
    | where DeviceName contains "server1"
    | join kind = inner (
    DeviceNetworkEvents
    | where DeviceName contains "server1"
    ) on "something"

Resources