SOLVED

KQL Syntax question

Copper Contributor

How do I rename the duration value from dependencies to seperate it from duration from requests.

 

Query is as follows:
let Client = union requests, dependencies
| where cloud_RoleName contains 'EUWPGTP018WAP04' or target contains 'client';
Client
| project operation_Name, operation_ParentId, operation_Id, duration
| join (Client | where operation_ParentId contains operation_Id)
    on operation_Id

4 Replies

@Vincent20, I am not sure I understood your question nor the goal of your query. But if you want to rename a column, you have to use extend+project-away or simply project-rename.

 

For example

 

dependencies
| extend dependencyDuration = duration
| project-away duration
 
or 
 
dependencies
| project-rename dependencyDuration = duration

Thank you for this. So the scenario is as follows: I have two tables Dependencies and Requests. Each of these have a column called Duration. So the query I have above merges columns in table 1(Dependencies) and table 2(requests) and combines all common columns in both as one. The problem is that I want to show all columns whether it is common or not, then rename the common column called duration so that I can Identify duration from dependencies and duration from requests. I look forward to your kind response@hspinto 

best response confirmed by Vincent20 (Copper Contributor)
Solution

@Vincent20 

 

Like this?

union isfuzzy=true 
(Dependencies 
| extend DurationA = Duration), 
(Requests
| extend DurationB = Duration)
| summarize  by DurationA, DurationB

 

 

Example using demo Tables 

Go to Log Analytics and run query

union isfuzzy=true 
(Event 
| extend DurationA = EventID
| project DurationA
), 
(SecurityEvent
| extend DurationB = EventID
| project DurationB)
| summarize  count(DurationA), count(DurationB)
count_DurationA count_DurationB
601533 601533

 

This is great. Exactly what I want to achieve.
1 best response

Accepted Solutions
best response confirmed by Vincent20 (Copper Contributor)
Solution

@Vincent20 

 

Like this?

union isfuzzy=true 
(Dependencies 
| extend DurationA = Duration), 
(Requests
| extend DurationB = Duration)
| summarize  by DurationA, DurationB

 

 

Example using demo Tables 

Go to Log Analytics and run query

union isfuzzy=true 
(Event 
| extend DurationA = EventID
| project DurationA
), 
(SecurityEvent
| extend DurationB = EventID
| project DurationB)
| summarize  count(DurationA), count(DurationB)
count_DurationA count_DurationB
601533 601533

 

View solution in original post