project operator

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Select the columns to include, rename or drop, and insert new computed columns.

The order of the columns in the result is specified by the order of the arguments. Only the columns specified in the arguments are included in the result. Any other columns in the input are dropped.

Syntax

T | project [ColumnName | (ColumnName[,]) =] Expression [, ...]

or

T | project ColumnName [= Expression] [, ...]

Learn more about syntax conventions.

Parameters

• Either ColumnName or Expression must be specified.
• If there's no Expression, then a column of ColumnName must appear in the input.
• If ColumnName is omitted, the output column name of Expression will be automatically generated.
• If Expression returns more than one column, a list of column names can be specified in parentheses. If a list of the column names isn't specified, all Expression's output columns with generated names will be added to the output.

Returns

A table with columns that were named as arguments. Contains same number of rows as the input table.

Examples

Only show specific columns

Only show the EventId, State, EventType of the StormEvents table.

StormEvents
| project EventId, State, EventType

The following results table shows only the top 10 results.

Potential manipulations using project

The following query renames the BeginLocation column and creates a new column called TotalInjuries from a calculation over two existing columns.

StormEvents
| project StartLocation = BeginLocation, TotalInjuries = InjuriesDirect + InjuriesIndirect
| where TotalInjuries > 5

The following table shows only the first 10 results.