Create calculated columns and append them to the result set.
[dataset name]| extend alias1 = expression1, alias2 = expression2, alias3 = ...
|['dataset']||string||The input dataset table.|
|ColumnName (FielddName)||string||The name of the column to add or update.|
|Expression||expression||A calculation over the columns of the dataset.|
A copy of the input dataset result, such that:
- Column names noted by extend that already exist in the input are removed and appended as their new calculated values.
- Column names noted by extend that do not exist in the input are appended as their new calculated values.
['http-logs']| where _time >= ago(2d)| extend method , ['geo.city'], ['geo.country'], content_type
['http-logs']| where _time >= ago(2d)| extend type= content_type, method2=method, interval=req_duration_ms