fork 运算符fork operator

• 10/29/2020
• • o
  • v

并行运行多个 consumer 运算符。Runs multiple consumer operators in parallel.

语法Syntax

T | fork [ name=](subquery) [ name=](subquery) ...T | fork [ name=](subquery) [ name=](subquery) ...

参数Arguments

• subquery 是查询运算符的下游管道subquery is a downstream pipeline of query operators
• name 是子查询结果表的临时名称name is a temporary name for the subquery result table

返回Returns

多个结果表，每个子查询一个。Multiple result tables, one for each of the subqueries.

支持的运算符Supported Operators

as, count, extend, parse, where, take, project, project-away, project-keep, project-rename, project-reorder, summarize, top, top-nested, sort, mv-expand, reduceas, count, extend, parse, where, take, project, project-away, project-keep, project-rename, project-reorder, summarize, top, top-nested, sort, mv-expand, reduce

备注Notes

• materialize 函数可用作在分支上使用 join 或 union 的替代方法。materialize function can be used as a replacement for using join or union on fork legs. 输入流将通过 materialize 进行缓存，然后缓存的表达式可以在 join/union 分支中使用。The input stream will be cached by materialize and then the cached expression can be used in join/union legs.

• 通过 name 参数或 as 运算符给定的名称将用作 Kusto.Explorer 工具中结果选项卡的名称。A name, given by the name argument or by using as operator will be used as the to name the result tab in Kusto.Explorer tool.

• 请避免将 fork 与单个子查询一起使用。Avoid using fork with a single subquery.

• 优先使用批处理与表格表达式语句的 materialize，而不是 fork 运算符。Prefer using batch with materialize of tabular expression statements over fork operator.

示例Examples

KustoLogs
| where Timestamp > ago(1h)
| fork
    ( where Level == "Error" | project EventText | limit 100 )
    ( project Timestamp, EventText | top 1000 by Timestamp desc)
    ( summarize min(Timestamp), max(Timestamp) by ActivityID )
 
// In the following examples the result tables will be named: Errors, EventsTexts and TimeRangePerActivityID
KustoLogs
| where Timestamp > ago(1h)
| fork
    ( where Level == "Error" | project EventText | limit 100 | as Errors )
    ( project Timestamp, EventText | top 1000 by Timestamp desc | as EventsTexts )
    ( summarize min(Timestamp), max(Timestamp) by ActivityID | as TimeRangePerActivityID )
    
 KustoLogs
| where Timestamp > ago(1h)
| fork
    Errors = ( where Level == "Error" | project EventText | limit 100 )
    EventsTexts = ( project Timestamp, EventText | top 1000 by Timestamp desc )
    TimeRangePerActivityID = ( summarize min(Timestamp), max(Timestamp) by ActivityID )