Need more information on the serialize command

Valued Contributor

I am using the serialize command, and having it show the row number, but I don't understand how it determines which row gets the row number.  The command I am using below

SecurityIncident
| where ProviderIncidentId == 283
| serialize rn=row_number()
| extend RowNumber= rn
| order by rn asc

 

Returns the following order

GaryBushey_0-1629471478214.png

Which doesn't make sense to me.  I would have thought the row order would be based on TimeGenerated but it does not appear that is the case.   Can anyone tell me how it determines the row order?

1 Reply

After more reading and playing around, I figured out that it is up to me to order the list BEFORE I serialize it.  The serialize command just takes the rows in the order they were presented by the query.