Forum Discussion
KQL projecting columns from a Table and a Watchlist
I have been beating my head on this. I have been trying to project just the columns I need from a table and a watchlist, for example: DeviceInfo | where DeviceName == "dc1.lab.com" | lookup kindin...
"lookup" is more of a matching operator. If you want to have the columns from the watchlist show up, use a "join" command.
So, I realized when I got to work this morning that you can use the project. The problem I realized is that you can't tab complete columns from a watchlist since it is not pre-loaded data.
Thank you for the post! Still trying to get better at KQL and understanding the entire environment
Thank you for the post! Still trying to get better at KQL and understanding the entire environment