Kusto Query Language (KQL) - Extend Operator

Basic Syntax:

The basic syntax for the extend operator is as follows:

TableName
| extend NewColumnName = [Expression]
    

• TableName: Specifies the name of the table you want to work with.
• NewColumnName: Specifies the name of the new column you want to create.
• Expression: Specifies the expression used to calculate the values for the new column.

Common Use Cases:

1. Creating Calculated Columns:

The primary purpose of the extend operator is to create new calculated columns based on existing data or expressions. You can perform mathematical operations, apply functions, or manipulate data to generate new column values.

MyTable
| extend TotalRevenue = SalesAmount + TaxAmount
    

2. Data Transformation:

You can use extend to transform data by creating columns that meet specific criteria or conditions. This can be useful for data cleansing or preparation.

MyTable
| extend IsHighValueCustomer = iif(TotalPurchases > 1000, true, false)
    

3. String Manipulation:

For text-based data, you can use extend to manipulate strings, concatenate values, or extract substrings.

MyTable
| extend FullName = FirstName + " " + LastName
    

4. Date and Time Calculations:

When working with date and time data, you can use extend to calculate durations, time differences, or create new date-related columns.

MyTable
| extend DaysSinceLastInteraction = now() - LastInteractionDateTime
    

The extend operator is a versatile tool for enhancing and enriching your data by adding new columns based on expressions or transformations. It allows you to customize your data for analysis and reporting.