Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Creates calculated columns and append them to the result set.
Syntax
T | extend
[ColumnName | (
ColumnName[,
...])
=
] Expression [,
...]
Learn more about syntax conventions.
Parameters
Name | Type | Required | Description |
---|---|---|---|
T | string |
✔️ | Tabular input to extend. |
ColumnName | string |
Name of the column to add or update. | |
Expression | string |
✔️ | Calculation to perform over the input. |
- If ColumnName is omitted, the output column name of Expression is automatically generated.
- If Expression returns more than one column, a list of column names can be specified in parentheses. Then, Expression's output columns is given the specified names. If a list of the column names isn't specified, all Expression's output columns with generated names are added to the output.
Returns
Returns a copy of the input tabular result set, such that:
- Column names noted by
extend
that already exist in the input are removed and appended as their new calculated values. - Column names noted by
extend
that don't exist in the input are appended as their new calculated values.
Note
The extend
operator adds a new column to the input result set, which does
not have an index. In most cases, if the new column is set to be exactly
the same as an existing table column that has an index, Kusto can automatically
use the existing index. However, in some complex scenarios this propagation is
not done. In such cases, if the goal is to rename a column, use the project-rename
operator instead.
Examples
The following example shows how to use the extend
operator to create a new column called Duration
that calculates the difference between the EndTime
and StartTime
columns in the StormEvents
table.
StormEvents
| project EndTime, StartTime
| extend Duration = EndTime - StartTime
The following table shows only the first 10 results. To see the full output, run the query.
EndTime | StartTime | Duration |
---|---|---|
2007-01-01T00:00:00Z | 2007-01-01T00:00:00Z | 00:00:00 |
2007-01-01T00:25:00Z | 2007-01-01T00:25:00Z | 00:00:00 |
2007-01-01T02:24:00Z | 2007-01-01T02:24:00Z | 00:00:00 |
2007-01-01T03:45:00Z | 2007-01-01T03:45:00Z | 00:00:00 |
2007-01-01T04:35:00Z | 2007-01-01T04:35:00Z | 00:00:00 |
2007-01-01T04:37:00Z | 2007-01-01T03:37:00Z | 01:00:00 |
2007-01-01T05:00:00Z | 2007-01-01T00:00:00Z | 05:00:00 |
2007-01-01T05:00:00Z | 2007-01-01T00:00:00Z | 05:00:00 |
2007-01-01T06:00:00Z | 2007-01-01T00:00:00Z | 06:00:00 |
2007-01-01T06:00:00Z | 2007-01-01T00:00:00Z | 06:00:00 |
Related content
- Use series_stats to return multiple columns