Forum Discussion
KQL projecting columns from a Table and a Watchlist
I have been beating my head on this. I have been trying to project just the columns I need from a table and a watchlist, for example: DeviceInfo | where DeviceName == "dc1.lab.com" | lookup kindin...
"lookup" is more of a matching operator. If you want to have the columns from the watchlist show up, use a "join" command.
- So, I realized when I got to work this morning that you can use the project. The problem I realized is that you can't tab complete columns from a watchlist since it is not pre-loaded data.
Thank you for the post! Still trying to get better at KQL and understanding the entire environment
