fork operator

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Runs multiple consumer operators in parallel.

Syntax

T | fork [name=](subquery) [name=](subquery) ...

Learn more about syntax conventions.

Parameters

Supported query operators

• as
• count
• extend
• parse
• where
• take
• project
• project-away
• project-keep
• project-rename
• project-reorder
• summarize
• top
• top-nested
• sort
• mv-expand
• reduce

Returns

Multiple result tables, one for each of the subquery arguments.

Tips

• Use materialize as a replacement for join or union on fork legs. The input stream is cached by materialize and then the cached expression can be used in join/union legs.

• Use batch with materialize of tabular expression statements instead of the fork operator.

Examples

The following example returns two tables with unnamed columns.

StormEvents
| where State == "FLORIDA"
| fork
    ( where DeathsDirect + DeathsIndirect > 1)
    ( where InjuriesDirect + InjuriesIndirect > 1)

Output

This output shows the first few rows and columns of the result table.

Named subqueries

In the following examples, the result table is named "StormsWithDeaths" and "StormsWithInjuries".

StormEvents
| where State == "FLORIDA"
| fork
    (where DeathsDirect + DeathsIndirect > 1 | as StormsWithDeaths)
    (where InjuriesDirect + InjuriesIndirect > 1 | as StormsWithInjuries)

StormEvents
| where State == "FLORIDA"
| fork
    StormsWithDeaths = (where DeathsDirect + DeathsIndirect > 1)
    StormsWithInjuries = (where InjuriesDirect + InjuriesIndirect > 1)

Output

This output shows the first few rows and columns of the result table.