extend operator

Create calculated columns and append them to the result set.

Syntax

T | extend [ColumnName | (ColumnName[, ...]) =] Expression [, ...]

Parameters

• If ColumnName is omitted, the output column name of Expression will be automatically generated.
• If Expression returns more than one column, a list of column names can be specified in parentheses. Then, Expression's output columns will be given the specified names. If a list of the column names is not specified, all Expression's output columns with generated names will be added to the output.

Returns

A copy of the input tabular result set, such that:

1. Column names noted by extend that already exist in the input are removed and appended as their new calculated values.
2. Column names noted by extend that do not exist in the input are appended as their new calculated values.

[!NOTE] The extend operator adds a new column to the input result set, which does not have an index. In most cases, if the new column is set to be exactly the same as an existing table column that has an index, pql can automatically use the existing index. However, in some complex scenarios this propagation is not done.

Example

StormEvents
| project EndTime, StartTime
| extend Duration = EndTime - StartTime

The following table shows only the first 10 results. To see the full output, run the query.