Tabular Operators

extend operator

Create calculated columns and append them to the result set.

Syntax

| extend alias1 = expression1, alias2 = expression2, alias3 = ...

Arguments

nametypedescription
AliasstringThe name of the column to add or update.
ExpressionexpressionA calculation over the columns of the dataset.

Returns

A copy of the input dataset result, such that:

  • Column names noted by extend that already exist in the input are removed and appended as their new calculated values.
  • Column names noted by extend that do not exist in the input are appended as their new calculated values.

Examples

['http-logs']
| extend upper_ct = toupper(content_type)
['http-logs']
| extend extension = extract('/([a-z]*)', 1, content_type), duration_bucket=bin(req_duration_ms, 100)