extend 运算符extend operator

创建计算列并将其追加到结果集中。Create calculated columns and append them to the result set.

T | extend duration = endTime - startTime

语法Syntax

T | extend [ ColumnName | (ColumnName [, ...]) =] Expression [, ...]T | extend [ ColumnName | (ColumnName [, ...]) =] Expression [, ...]

参数Arguments

  • T :输入表格结果集。T : The input tabular result set.
  • ColumnName:可选。ColumnName: Optional. 要添加或更新的列的名称。The name of the column to add or update. 如果省略,则会生成名称。If omitted, the name will be generated. 如果 Expression 返回多个列,则可在括号中指定列名列表。If Expression returns more than one column, a list of column names can be specified in parentheses. 在这种情况下,会将指定的名称赋予 Expression 的输出列,并会删除其余的输出列(如果有)。In this case Expression 's output columns will be given the specified names, dropping the rest of the output columns, if there are any. 如果未指定列名列表,则 Expression 的所有具有所生成名称的输出列都将添加到输出中。If a list of the column names is not specified, all Expression 's output columns with generated names will be added to the output.
  • 表达式: 对输入的列进行计算。Expression: A calculation over the columns of the input.

返回Returns

输入表格结果集的副本,使得:A copy of the input tabular result set, such that:

  1. 已存在于输入中的使用 extend 标记的列名会被删除,然后作为新的计算值进行追加。Column names noted by extend that already exist in the input are removed and appended as their new calculated values.
  2. 输入中不存在的使用 extend 标记的列名将作为其新的计算值追加。Column names noted by extend that do not exist in the input are appended as their new calculated values.

提示Tips

  • extend 运算符会将新列添加到输入结果集中,该列没有索引。The extend operator adds a new column to the input result set, which does not have an index. 在大多数情况下,如果将新列设置为与具有索引的现有表列完全相同,则 Kusto 可以自动使用现有索引。In most cases, if the new column is set to be exactly the same as an existing table column that has an index, Kusto can automatically use the existing index. 但在某些复杂情况下,此传播并未完成。However, in some complex scenarios this propagation is not done. 在此类情况下,如果目标是重命名列,请改用 project-rename 运算符In such cases, if the goal is to rename a column, use the project-rename operator instead.

示例Example

Logs
| extend
    Duration = CreatedOn - CompletedOn
    , Age = now() - CreatedOn
    , IsSevere = Level == "Critical" or Level == "Error"

可以使用 series_stats 函数返回多个列。You can use the series_stats function to return multiple columns.