Tabular Operators

extend operator

Create calculated columns and append them to the result set.

Syntax

[dataset name]
| extend alias1 = expression1, alias2 = expression2, alias3 = ...

Arguments

nametypedescription
['dataset']stringThe input dataset table.
ColumnName (FielddName)stringThe name of the column to add or update.
ExpressionexpressionA calculation over the columns of the dataset.

Returns

A copy of the input dataset result, such that:

  • Column names noted by extend that already exist in the input are removed and appended as their new calculated values.
  • Column names noted by extend that do not exist in the input are appended as their new calculated values.

Examples

['http-logs']
| where _time >= ago(2d)
| extend method , ['geo.city'], ['geo.country'], content_type
['http-logs']
| where _time >= ago(2d)
| extend type= content_type, method2=method, interval=req_duration_ms