Kusto Query Language (KQL) - Project Operator

Basic Syntax:

The basic syntax for the project operator is as follows:

TableName
| project [NewColumnName1] = [Expression1], [NewColumnName2] = [Expression2], ...
    

• TableName: Specifies the name of the table you want to work with.
• NewColumnName1, NewColumnName2, ...: Specifies the names of the new columns you want to create.
• Expression1, Expression2, ...: Specifies the expressions used to calculate the values for the new columns.

Common Use Cases:

1. Selecting Specific Columns:

The primary purpose of the project operator is to select and display specific columns from a table while excluding others. It allows you to customize the output of your query.

MyTable
| project ProductName, SalesAmount, OrderDate
    

2. Renaming Columns:

You can use project to rename columns by specifying new column names in the projection. This is useful for providing more descriptive or user-friendly names.

MyTable
| project NewName = OldColumnName, CustomerFullName = FirstName + " " + LastName
    

3. Calculated Columns:

With project, you can create calculated columns by applying expressions to existing data. This allows you to derive new information from your data.

MyTable
| project DiscountedPrice = Price * 0.9, Revenue = Quantity * Price
    

4. Data Transformation:

You can use project to transform data, apply conditional logic, or extract specific information from columns.

MyTable
| project ProductCategory, IsHighValue = iif(TotalSales > 1000, true, false)
    

The project operator is a fundamental tool for customizing and shaping the output of your KQL queries, allowing you to select, rename, and create columns as needed for analysis and reporting.