Skip to content

Latest commit

 

History

History
73 lines (55 loc) · 3 KB

extend-operator.md

File metadata and controls

73 lines (55 loc) · 3 KB
Raw
title description ms.reviewer ms.topic ms.date
extend operator
Learn how to use the extend operator to create calculated columns and append them to the result set.
alexans
reference
12/11/2022

extend operator

Creates calculated columns and append them to the result set.

Syntax

T | extend [ColumnName | (ColumnName[, ...]) =] Expression [, ...]

[!INCLUDE syntax-conventions-note]

Parameters

Name Type Required Description
T string ✔️ Tabular input to extend.
ColumnName string Name of the column to add or update.
Expression string ✔️ Calculation to perform over the input.
  • If ColumnName is omitted, the output column name of Expression is automatically generated.
  • If Expression returns more than one column, a list of column names can be specified in parentheses. Then, Expression's output columns is given the specified names. If a list of the column names isn't specified, all Expression's output columns with generated names are added to the output.

Returns

A copy of the input tabular result set, such that:

  1. Column names noted by extend that already exist in the input are removed and appended as their new calculated values.
  2. Column names noted by extend that don't exist in the input are appended as their new calculated values.

Note

The extend operator adds a new column to the input result set, which does not have an index. In most cases, if the new column is set to be exactly the same as an existing table column that has an index, Kusto can automatically use the existing index. However, in some complex scenarios this propagation is not done. In such cases, if the goal is to rename a column, use the project-rename operator instead.

Example

[!div class="nextstepaction"] Run the query

StormEvents
| project EndTime, StartTime
| extend Duration = EndTime - StartTime

The following table shows only the first 10 results. To see the full output, run the query.

EndTime StartTime Duration
2007-01-01T00:00:00Z 2007-01-01T00:00:00Z 00:00:00
2007-01-01T00:25:00Z 2007-01-01T00:25:00Z 00:00:00
2007-01-01T02:24:00Z 2007-01-01T02:24:00Z 00:00:00
2007-01-01T03:45:00Z 2007-01-01T03:45:00Z 00:00:00
2007-01-01T04:35:00Z 2007-01-01T04:35:00Z 00:00:00
2007-01-01T04:37:00Z 2007-01-01T03:37:00Z 01:00:00
2007-01-01T05:00:00Z 2007-01-01T00:00:00Z 05:00:00
2007-01-01T05:00:00Z 2007-01-01T00:00:00Z 05:00:00
2007-01-01T06:00:00Z 2007-01-01T00:00:00Z 06:00:00
2007-01-01T06:00:00Z 2007-01-01T00:00:00Z 06:00:00

Related content