extend operator
Create calculated columns and append them to the result set.
T | extend duration = endTime - startTime
Syntax
T | extend [ColumnName | (ColumnName[, ...]) =] Expression [, ...]
Arguments
- T: The input tabular result set.
- ColumnName: Optional. The name of the column to add or update. If omitted, the name will be generated. If Expression returns more than one column, a list of column names can be specified in parentheses. In this case Expression's output columns will be given the specified names, dropping the rest of the output columns, if there are any. If a list of the column names is not specified, all Expression's output columns with generated names will be added to the output.
- Expression: A calculation over the columns of the input.
Returns
A copy of the input tabular result set, such that:
- Column names noted by
extendthat already exist in the input are removed and appended as their new calculated values. - Column names noted by
extendthat do not exist in the input are appended as their new calculated values.
Tips
- The
extendoperator adds a new column to the input result set, which does not have an index. In most cases, if the new column is set to be exactly the same as an existing table column that has an index, Kusto can automatically use the existing index. However, in some complex scenarios this propagation is not done. In such cases, if the goal is to rename a column, use theproject-renameoperator instead.
Example
Logs
| extend
Duration = CreatedOn - CompletedOn
, Age = now() - CreatedOn
, IsSevere = Level == "Critical" or Level == "Error"
You can use the series_stats function to return multiple columns.