as operator

  • Article
  • 09/30/2024

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Binds a name to the operator's input tabular expression. This allows the query to reference the value of the tabular expression multiple times without breaking the query and binding a name through the let statement.

To optimize multiple uses of the as operator within a single query, see Named expressions.

Syntax

T | as [hint.materialized = Materialized] Name

Learn more about syntax conventions.

Parameters

Name Type Required Description
T string ✔️ The tabular expression to rename.
Name string ✔️ The temporary name for the tabular expression.
hint.materialized bool If Materialized is set to true, the value of the tabular expression will be as if it was wrapped by a materialize() function call. Otherwise, the value will be recalculated on every reference.

Note

  • The name given by as will be used in the withsource= column of union, the source_ column of find, and the $table column of search.
  • The tabular expression named using the operator in a join's outer tabular input ($left) can also be used in the join's tabular inner input ($right).

Examples

In the following two examples the union's generated TableName column will consist of 'T1' and 'T2'.

Run the query

range x from 1 to 10 step 1 
| as T1 
| union withsource=TableName (range x from 1 to 10 step 1 | as T2)

Alternatively, you can write the same example as follows:

Run the query

union withsource=TableName (range x from 1 to 10 step 1 | as T1), (range x from 1 to 10 step 1 | as T2)

In the following example, the 'left side' of the join will be: MyLogTable filtered by type == "Event" and Name == "Start" and the 'right side' of the join will be: MyLogTable filtered by type == "Event" and Name == "Stop"

MyLogTable  
| where type == "Event"
| as T
| where Name == "Start"
| join (
    T
    | where Name == "Stop"
) on ActivityId