fork 运算符fork operator
并行运行多个 consumer 运算符。Runs multiple consumer operators in parallel.
语法Syntax
T |
fork
[ name=
](
subquery)
[ name=
](
subquery)
...T |
fork
[ name=
](
subquery)
[ name=
](
subquery)
...
参数Arguments
- subquery 是查询运算符的下游管道subquery is a downstream pipeline of query operators
- name 是子查询结果表的临时名称name is a temporary name for the subquery result table
返回Returns
多个结果表,每个子查询一个。Multiple result tables, one for each of the subqueries.
支持的运算符Supported Operators
as
, count
, extend
, parse
, where
, take
, project
, project-away
, project-keep
, project-rename
, project-reorder
, summarize
, top
, top-nested
, sort
, mv-expand
, reduce
as
, count
, extend
, parse
, where
, take
, project
, project-away
, project-keep
, project-rename
, project-reorder
, summarize
, top
, top-nested
, sort
, mv-expand
, reduce
备注Notes
materialize
函数可用作在分支上使用join
或union
的替代方法。materialize
function can be used as a replacement for usingjoin
orunion
on fork legs. 输入流将通过 materialize 进行缓存,然后缓存的表达式可以在 join/union 分支中使用。The input stream will be cached by materialize and then the cached expression can be used in join/union legs.通过
name
参数或as
运算符给定的名称将用作Kusto.Explorer
工具中结果选项卡的名称。A name, given by thename
argument or by usingas
operator will be used as the to name the result tab inKusto.Explorer
tool.请避免将
fork
与单个子查询一起使用。Avoid usingfork
with a single subquery.优先使用批处理与表格表达式语句的
materialize
,而不是fork
运算符。Prefer using batch withmaterialize
of tabular expression statements overfork
operator.
示例Examples
KustoLogs
| where Timestamp > ago(1h)
| fork
( where Level == "Error" | project EventText | limit 100 )
( project Timestamp, EventText | top 1000 by Timestamp desc)
( summarize min(Timestamp), max(Timestamp) by ActivityID )
// In the following examples the result tables will be named: Errors, EventsTexts and TimeRangePerActivityID
KustoLogs
| where Timestamp > ago(1h)
| fork
( where Level == "Error" | project EventText | limit 100 | as Errors )
( project Timestamp, EventText | top 1000 by Timestamp desc | as EventsTexts )
( summarize min(Timestamp), max(Timestamp) by ActivityID | as TimeRangePerActivityID )
KustoLogs
| where Timestamp > ago(1h)
| fork
Errors = ( where Level == "Error" | project EventText | limit 100 )
EventsTexts = ( project Timestamp, EventText | top 1000 by Timestamp desc )
TimeRangePerActivityID = ( summarize min(Timestamp), max(Timestamp) by ActivityID )