Forum Discussion
Need more information on the serialize command
I am using the serialize command, and having it show the row number, but I don't understand how it determines which row gets the row number. The command I am using below
SecurityIncident
| where ProviderIncidentId == 283
| serialize rn=row_number()
| extend RowNumber= rn
| order by rn asc
Returns the following order
Which doesn't make sense to me. I would have thought the row order would be based on TimeGenerated but it does not appear that is the case. Can anyone tell me how it determines the row order?
After more reading and playing around, I figured out that it is up to me to order the list BEFORE I serialize it. The serialize command just takes the rows in the order they were presented by the query.
