I have a simple query like below;
union isfuzzy=true
availabilityResults,
requests,
exceptions,
pageViews,
traces,
customEvents,
dependencies
| order by timestamp desc
| take 100
This returns all available columns, which is fine. Then when I use following;
union isfuzzy=true
availabilityResults,
requests,
exceptions,
pageViews,
traces,
customEvents,
dependencies
| order by timestamp desc
| take 100
| project customDimensions.ApplicationName
This only returns ApplicationName
column, this is also fine.
But what I want it to get additional column on top of existing ones, similar to:
union isfuzzy=true
availabilityResults,
requests,
exceptions,
pageViews,
traces,
customEvents,
dependencies
| order by timestamp desc
| take 100
| project *, customDimensions.ApplicationName
But *
wildcard does not work here. Is there any way to achieve this?
CodePudding user response:
If I understand correctly, you want the result table to include all existing columns, and extend another calculated column in addition to those.
If that's correct, you can use the extend
operator.
e.g.:
union isfuzzy=true
availabilityResults,
requests,
exceptions,
pageViews,
traces,
customEvents,
dependencies
| top 100 by timestamp desc
| extend ApplicationName = customDimensions.ApplicationName