as operator

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Binds a name to the operator's input tabular expression. This operator allows the query to reference the value of the tabular expression multiple times without breaking the query and binding a name through the let statement.

To optimize multiple uses of the as operator within a single query, see Named expressions.

Syntax

T | as [hint.materialized = Materialized] Name

Learn more about syntax conventions.

Parameters

Name Type Required Description
T string ✔️ The tabular expression to rename.
Name string ✔️ The temporary name for the tabular expression.
hint.materialized bool If Materialized is set to true, the value of the tabular expression output is wrapped by a materialize() function call. Otherwise, the value is recalculated on every reference.

Note

  • The name given by as is used in the withsource= column of union, the source_ column of find, and the $table column of search.
  • The tabular expression named using the operator in a join's outer tabular input ($left) can also be used in the join's tabular inner input ($right).

Examples

In the following two examples, the generated TableName column consists of 'T1' and 'T2'.

Run the query

range x from 1 to 5 step 1 
| as T1 
| union withsource=TableName (range x from 1 to 5 step 1 | as T2)

Alternatively, you can write the same example as follows:

Run the query

union withsource=TableName (range x from 1 to 5 step 1 | as T1), (range x from 1 to 5 step 1 | as T2)

Output

TableName x
T1 1
T1 2
T1 3
T1 4
T1 5
T2 1
T2 2
T2 3
T2 4
T2 5

In the following example, the 'left side' of the join is: MyLogTable filtered by type == "Event" and Name == "Start" and the 'right side' of the join is: MyLogTable filtered by type == "Event" and Name == "Stop"

MyLogTable  
| where type == "Event"
| as T
| where Name == "Start"
| join (
    T
    | where Name == "Stop"
) on ActivityId