KQL Syntax question

New Contributor

How do I rename the duration value from dependencies to seperate it from duration from requests.


Query is as follows:
let Client = union requests, dependencies
| where cloud_RoleName contains 'EUWPGTP018WAP04' or target contains 'client';
| project operation_Name, operation_ParentId, operation_Id, duration
| join (Client | where operation_ParentId contains operation_Id)
    on operation_Id

4 Replies

@Vincent20, I am not sure I understood your question nor the goal of your query. But if you want to rename a column, you have to use extend+project-away or simply project-rename.


For example


| extend dependencyDuration = duration
| project-away duration
| project-rename dependencyDuration = duration

Thank you for this. So the scenario is as follows: I have two tables Dependencies and Requests. Each of these have a column called Duration. So the query I have above merges columns in table 1(Dependencies) and table 2(requests) and combines all common columns in both as one. The problem is that I want to show all columns whether it is common or not, then rename the common column called duration so that I can Identify duration from dependencies and duration from requests. I look forward to your kind response@hspinto 




Like this?

union isfuzzy=true 
| extend DurationA = Duration), 
| extend DurationB = Duration)
| summarize  by DurationA, DurationB



Example using demo Tables 

Go to Log Analytics and run query

union isfuzzy=true 
| extend DurationA = EventID
| project DurationA
| extend DurationB = EventID
| project DurationB)
| summarize  count(DurationA), count(DurationB)
count_DurationA count_DurationB
601533 601533


This is great. Exactly what I want to achieve.