extend operator

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Creates calculated columns and append them to the result set.

Syntax

T | extend [ColumnName | (ColumnName[, ...]) =] Expression [, ...]

Learn more about syntax conventions.

Parameters

• If ColumnName is omitted, the output column name of Expression is automatically generated.
• If Expression returns more than one column, a list of column names can be specified in parentheses. Then, Expression's output columns is given the specified names. If a list of the column names isn't specified, all Expression's output columns with generated names are added to the output.

Returns

Returns a copy of the input tabular result set, such that:

1. Column names noted by extend that already exist in the input are removed and appended as their new calculated values.
2. Column names noted by extend that don't exist in the input are appended as their new calculated values.

Examples

The following example shows how to use the extend operator to create a new column called Duration that calculates the difference between the EndTime and StartTime columns in the StormEvents table.

StormEvents
| project EndTime, StartTime
| extend Duration = EndTime - StartTime

The following table shows only the first 10 results. To see the full output, run the query.