Tabular operators
| Function | Description |
|---|---|
| count | Returns an integer representing the total number of records in the dataset. |
| distinct | Returns a dataset with unique values from the specified fields, removing any duplicate entries. |
| extend | Returns the original dataset with one or more new fields appended, based on the defined expressions. |
| extend-valid | Returns a table where the specified fields are extended with new values based on the given expression for valid rows. |
| externaldata | Returns a table with the specified schema, containing data retrieved from an external source. |
| getschema | Returns the schema of the input, including field names and their data types |
| join | Returns a dataset containing rows from two different tables based on conditions. |
| limit | Returns the top N rows from the input dataset. |
| lookup | Returns a dataset where rows from one dataset are enriched with matching columns from a lookup table based on conditions. |
| make-series | Returns a dataset where the specified field is aggregated into a time series. |
| mv-expand | Returns a dataset where the specified field is expanded into multiple rows. |
| order | Returns the input dataset, sorted according to the specified fields and order. |
| parse | Returns the input dataset with new fields added based on the specified parsing pattern. |
| parse-kv | Returns a dataset where key-value pairs are extracted from a string field into individual columns. |
| parse-where | Returns a dataset where values from a string are extracted based on a pattern. |
| project | Returns a dataset containing only the specified fields. |
| project-away | Returns the input dataset excluding the specified fields. |
| project-keep | Returns a dataset with only the specified fields. |
| project-rename | Returns a dataset where the specified field is renamed according to the specified pattern. |
| project-reorder | Returns a table with the specified fields reordered as requested followed by any unspecified fields in their original order. |
| redact | Returns the input dataset with sensitive data replaced or hashed. |
| sample | Returns a table containing the specified number of rows, selected randomly from the input dataset. |
| search | Returns all rows where the specified keyword appears in any field. |
| sort | Returns a table with rows ordered based on the specified fields. |
| summarize | Returns a table where each row represents a unique combination of values from the by fields, with the aggregated results calculated for the other fields. |
| take | Returns the specified number of rows from the dataset. |
| top | Returns the top N rows from the dataset based on the specified sorting criteria. |
| union | Returns all rows from the specified tables or queries. |
| where | Returns a filtered dataset containing only the rows where the condition evaluates to true. |
Browse by theme#
Filter and sort
Keep the rows you need, remove duplicates, sort them and take the top ones.
Shape columns
Choose, rename, reorder and compute the columns of the result.
Aggregate
Group rows and compute aggregates, counts and time series.
Combine tables
Join, look up and union data from several datasets.
Parse and transform
Parse strings into fields, expand arrays into rows and redact values.