Skip to content

Latest commit

 

History

History
111 lines (82 loc) · 3.84 KB

fork-operator.md

File metadata and controls

111 lines (82 loc) · 3.84 KB
Raw
title description ms.reviewer ms.topic ms.date zone_pivot_group_filename zone_pivot_groups
fork operator
Learn how to use the fork operator to run multiple consumer operators in parallel.
alexans
reference
03/15/2023
data-explorer/zone-pivot-groups.json
kql-flavors-all

fork operator

::: zone pivot="azuredataexplorer, fabric"

Runs multiple consumer operators in parallel.

Syntax

T | fork [name=](subquery) [name=](subquery) ...

[!INCLUDE syntax-conventions-note]

Parameters

Name Type Required Description
subquery string ✔️ A downstream pipeline of supported query operators.
name string A temporary name for the subquery result table.

Note

  • Avoid using fork with a single subquery.
  • The name of the results tab will be the same name as provided with the name parameter or the as operator.

Supported query operators

Returns

Multiple result tables, one for each of the subquery arguments.

Tips

  • Use materialize as a replacement for join or union on fork legs. The input stream will be cached by materialize and then the cached expression can be used in join/union legs.

  • Use batch with materialize of tabular expression statements instead of the fork operator.

Examples

Unnamed subqueries

[!div class="nextstepaction"] Run the query

StormEvents
| where State == "FLORIDA"
| fork
    ( where DeathsDirect + DeathsIndirect > 1)
    ( where InjuriesDirect + InjuriesIndirect > 1)

Named subqueries

In the following examples, the result tables will be named "StormsWithDeaths" and "StormsWithInjuries".

[!div class="nextstepaction"] Run the query

StormEvents
| where State == "FLORIDA"
| fork
    (where DeathsDirect + DeathsIndirect > 1 | as StormsWithDeaths)
    (where InjuriesDirect + InjuriesIndirect > 1 | as StormsWithInjuries)

[!div class="nextstepaction"] Run the query

StormEvents
| where State == "FLORIDA"
| fork
    StormsWithDeaths = (where DeathsDirect + DeathsIndirect > 1)
    StormsWithInjuries = (where InjuriesDirect + InjuriesIndirect > 1)

::: zone-end

::: zone pivot="azuremonitor"

This capability isn't supported in Azure Monitor

::: zone-end