Must Learn KQL Part 18: The Union Operator – Azure Cloud & AI Domain Blog (azurecloudai.blog)
As I did with parts/chapters 13-16 of this series for the series-within-the-series for data view manipulation, this part/chapter and the next form another mini-series of sorts. The Union and Join operators are important parts of the KQL journey as they represent opportunities to combine data from tables in different ways.
Before jumping directly off into talking about the Union operator, I think it’s best to start with describing the differences between Union and Join. Knowing the differences will allow you to determine which one to use for which scenario.
Union allows you to take the data from two or more tables and display the results (all rows from all tables) together. Join, on the other hand, is intended to produce more specific results by joining rows of just two tables through matching the values of columns you specify. You’ll see the differences once we get through this mini-series and you can get hands-on with the examples. I highly suggest taking the examples from this part/chapter and running them against the examples of Part 19 on the Join operator to get a proper comparison.