| count |
Returns an integer representing the total number of records in the dataset. |
| distinct |
Returns a dataset with unique values from the specified fields, removing any duplicate entries. |
| extend |
Returns the original dataset with one or more new fields appended, based on the defined expressions. |
| extend-valid |
Returns a table where the specified fields are extended with new values based on the given expression for valid rows. |
| externaldata |
Returns a table with the specified schema, containing data retrieved from an external source. |
| getschema |
Returns the schema of the input, including field names and their data types |
| join |
Returns a dataset containing rows from two different tables based on conditions. |
| limit |
Returns the top N rows from the input dataset. |
| lookup |
Returns a dataset where rows from one dataset are enriched with matching columns from a lookup table based on conditions. |
| make-series |
Returns a dataset where the specified field is aggregated into a time series. |
| mv-expand |
Returns a dataset where the specified field is expanded into multiple rows. |
| order |
Returns the input dataset, sorted according to the specified fields and order. |
| parse |
Returns the input dataset with new fields added based on the specified parsing pattern. |
| parse-kv |
Returns a dataset where key-value pairs are extracted from a string field into individual columns. |
| parse-where |
Returns a dataset where values from a string are extracted based on a pattern. |
| project |
Returns a dataset containing only the specified fields. |
| project-away |
Returns the input dataset excluding the specified fields. |
| project-keep |
Returns a dataset with only the specified fields. |
| project-rename |
Returns a dataset where the specified field is renamed according to the specified pattern. |
| project-reorder |
Returns a table with the specified fields reordered as requested followed by any unspecified fields in their original order. |
| redact |
Returns the input dataset with sensitive data replaced or hashed. |
| sample |
Returns a table containing the specified number of rows, selected randomly from the input dataset. |
| search |
Returns all rows where the specified keyword appears in any field. |
| sort |
Returns a table with rows ordered based on the specified fields. |
| summarize |
Returns a table where each row represents a unique combination of values from the by fields, with the aggregated results calculated for the other fields. |
| take |
Returns the specified number of rows from the dataset. |
| top |
Returns the top N rows from the dataset based on the specified sorting criteria. |
| union |
Returns all rows from the specified tables or queries. |
| where |
Returns a filtered dataset containing only the rows where the condition evaluates to true. |
