project operator

Select the columns to include, rename or drop, and insert new computed columns.

The order of the columns in the result is specified by the order of the arguments. Only the columns specified in the arguments are included in the result. Any other columns in the input are dropped.

Syntax

T | project [ColumnName | (ColumnName[,]) =] Expression [, ...]

or

T | project ColumnName [= Expression] [, ...]

Parameters

• Either ColumnName or Expression must be specified.
• If there's no Expression, then a column of ColumnName must appear in the input.
• If ColumnName is omitted, the output column name of Expression will be automatically generated.
• If Expression returns more than one column, a list of column names can be specified in parentheses. If a list of the column names isn't specified, all Expression's output columns with generated names will be added to the output.

[!NOTE] It's not recommended to return a new calculated column with the same name as an existing column in the input.

Returns

A table with columns that were named as arguments. Contains same number of rows as the input table.

Examples

Only show specific columns

Only show the EventId, State, EventType of the StormEvents table.

StormEvents
| project EventId, State, EventType

Will result in the following columns being returned.

Potential manipulations using project

The following query renames the BeginLocation column and creates a new column called TotalInjuries from a calculation over two existing columns.

StormEvents
| project StartLocation = BeginLocation, TotalInjuries = InjuriesDirect + InjuriesIndirect
| where TotalInjuries > 5

The following table shows only the first 10 results.

See also

• extend