Kusto Combine to then Join

%3CLINGO-SUB%20id%3D%22lingo-sub-2919854%22%20slang%3D%22en-US%22%3EKusto%20Combine%20to%20then%20Join%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2919854%22%20slang%3D%22en-US%22%3EIs%20it%20possible%20to%20output%202%20tables%20to%20then%20use%20in%20another%20join%20with%20a%20different%20query%3F%20For%20example%20say%20I%20have%20this%3CBR%20%2F%3Elet%20de1%3D%3CBR%20%2F%3EDeviceNetworkEvents%3CBR%20%2F%3E%7C%20where%20DeviceName%20contains%20%22server1%22%3CBR%20%2F%3E%7C%20where%20ProcessId%20%3D%3D%20%22111%22%3B%3CBR%20%2F%3Elet%20de2%3D%3CBR%20%2F%3EDeviceNetworkEvents%3CBR%20%2F%3E%7C%20where%20DeviceName%20contains%20%22server1%22%3CBR%20%2F%3E%7C%20where%20ConnectionString%20%3D%3D%20%22Connection%20Successful%22%3B%3CBR%20%2F%3Ede1%20%7C%20union%20de2%20by%20Something%3CBR%20%2F%3E%3CBR%20%2F%3ECan%20I%20then%20take%20the%20combined%20output%20of%20this%20and%20use%20the%20details%20from%20this%20to%20then%20do%20another%20union%20with%20a%20different%20table%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3001350%22%20slang%3D%22en-US%22%3ERe%3A%20Kusto%20Combine%20to%20then%20Join%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3001350%22%20slang%3D%22en-US%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1196055%22%20target%3D%22_blank%22%3E%40WillAda%3C%2FA%3E%20you%20can%20use%20the%20join%20operator.%3CBR%20%2F%3EDeviceNetworkEvents%3CBR%20%2F%3E%7C%20where%20DeviceName%20contains%20%22server1%22%3CBR%20%2F%3E%7C%20join%20kind%20%3D%20inner%20(%3CBR%20%2F%3EDeviceNetworkEvents%3CBR%20%2F%3E%7C%20where%20DeviceName%20contains%20%22server1%22%3CBR%20%2F%3E)%20on%20%22something%22%3C%2FLINGO-BODY%3E
New Contributor
Is it possible to output 2 tables to then use in another join with a different query? For example say I have this
let de1=
DeviceNetworkEvents
| where DeviceName contains "server1"
| where ProcessId == "111";
let de2=
DeviceNetworkEvents
| where DeviceName contains "server1"
| where ConnectionString == "Connection Successful";
de1 | union de2 by Something

Can I then take the combined output of this and use the details from this to then do another union with a different table?
1 Reply
@WillAda you can use the join operator.
DeviceNetworkEvents
| where DeviceName contains "server1"
| join kind = inner (
DeviceNetworkEvents
| where DeviceName contains "server1"
) on "something"