Jan 29 2020
09:32 PM
- last edited on
Apr 08 2022
10:16 AM
by
TechCommunityAP
Jan 29 2020
09:32 PM
- last edited on
Apr 08 2022
10:16 AM
by
TechCommunityAP
How do I rename the duration value from dependencies to seperate it from duration from requests.
Query is as follows:
let Client = union requests, dependencies
| where cloud_RoleName contains 'EUWPGTP018WAP04' or target contains 'client';
Client
| project operation_Name, operation_ParentId, operation_Id, duration
| join (Client | where operation_ParentId contains operation_Id)
on operation_Id
Jan 30 2020 02:52 PM
@Vincent20, I am not sure I understood your question nor the goal of your query. But if you want to rename a column, you have to use extend+project-away or simply project-rename.
For example
Jan 30 2020 03:59 PM
Thank you for this. So the scenario is as follows: I have two tables Dependencies and Requests. Each of these have a column called Duration. So the query I have above merges columns in table 1(Dependencies) and table 2(requests) and combines all common columns in both as one. The problem is that I want to show all columns whether it is common or not, then rename the common column called duration so that I can Identify duration from dependencies and duration from requests. I look forward to your kind response@hspinto
Jan 31 2020 12:26 AM
Solution
Like this?
union isfuzzy=true
(Dependencies
| extend DurationA = Duration),
(Requests
| extend DurationB = Duration)
| summarize by DurationA, DurationB
Example using demo Tables
Go to Log Analytics and run query
union isfuzzy=true
(Event
| extend DurationA = EventID
| project DurationA
),
(SecurityEvent
| extend DurationB = EventID
| project DurationB)
| summarize count(DurationA), count(DurationB)
count_DurationA | count_DurationB |
---|---|
601533 | 601533 |
Jan 31 2020 12:26 AM
Solution
Like this?
union isfuzzy=true
(Dependencies
| extend DurationA = Duration),
(Requests
| extend DurationB = Duration)
| summarize by DurationA, DurationB
Example using demo Tables
Go to Log Analytics and run query
union isfuzzy=true
(Event
| extend DurationA = EventID
| project DurationA
),
(SecurityEvent
| extend DurationB = EventID
| project DurationB)
| summarize count(DurationA), count(DurationB)
count_DurationA | count_DurationB |
---|---|
601533 | 601533 |