KQL projecting columns from a Table and a Watchlist

[Aaron_Platek]

I have been beating my head on this. I have been trying to project just the columns I need from a table and a watchlist, for example:

DeviceInfo
| where DeviceName == "dc1.lab.com"
| lookup kindinner _GetWatchlist('Device_Name')
on $left.host_s == right.SearchKey

From here I would like to project columns from the DeviceInfo table and the Watchlist table, but it does not populate the columns from the watchlist only from the column. Can anyone point me in the right direction?

[#2]

"lookup" is more of a matching operator. If you want to have the columns from the watchlist show up, use a "join" command.

[#3]

So, I realized when I got to work this morning that you can use the project. The problem I realized is that you can't tab complete columns from a watchlist since it is not pre-loaded data.

Thank you for the post! Still trying to get better at KQL and understanding the entire environment