extend operator
Creates calculated columns and appends them to the result set.
Syntax
| extend alias1 = expression1, alias2 = expression2, alias3 = ...Arguments
| name | type | description |
|---|---|---|
| Alias | string | The name of the column to add or update. |
| Expression | expression | A calculation over the columns of the dataset. |
Returns
A copy of the input dataset result similar to the one below:
- Column names noted by extend that already exist in the input are removed and appended as their new calculated values.
- Column names noted by extend that do not exist in the input are appended as their new calculated values.
Examples
['http-logs']
| extend upper_ct = toupper(content_type)['http-logs']
| extend extension = extract('/([a-z]*)', 1, content_type), duration_bucket=bin(req_duration_ms, 100)