fork operator
Runs multiple consumer operators in parallel.
Syntax
T |
fork
[name=
](
subquery)
[name=
](
subquery)
...
Learn more about syntax conventions.
Parameters
Name | Type | Required | Description |
---|---|---|---|
subquery | string |
✔️ | A downstream pipeline of supported query operators. |
name | string |
A temporary name for the subquery result table. |
Note
- Avoid using
fork
with a single subquery. - The name of the results tab will be the same name as provided with the
name
parameter or theas
operator.
Supported query operators
as
count
extend
parse
where
take
project
project-away
project-keep
project-rename
project-reorder
summarize
top
top-nested
sort
mv-expand
reduce
Returns
Multiple result tables, one for each of the subquery arguments.
Tips
Use
materialize
as a replacement forjoin
orunion
on fork legs. The input stream will be cached by materialize and then the cached expression can be used in join/union legs.Use batch with
materialize
of tabular expression statements instead of thefork
operator.
Examples
Unnamed subqueries
StormEvents
| where State == "FLORIDA"
| fork
( where DeathsDirect + DeathsIndirect > 1)
( where InjuriesDirect + InjuriesIndirect > 1)
Named subqueries
In the following examples, the result tables will be named "StormsWithDeaths" and "StormsWithInjuries".
StormEvents
| where State == "FLORIDA"
| fork
(where DeathsDirect + DeathsIndirect > 1 | as StormsWithDeaths)
(where InjuriesDirect + InjuriesIndirect > 1 | as StormsWithInjuries)
StormEvents
| where State == "FLORIDA"
| fork
StormsWithDeaths = (where DeathsDirect + DeathsIndirect > 1)
StormsWithInjuries = (where InjuriesDirect + InjuriesIndirect > 1)
This capability isn't supported in Azure Monitor
Feedback
https://aka.ms/ContentUserFeedback.
Kommer snart: I hele 2024 udfaser vi GitHub-problemer som feedbackmekanisme for indhold og erstatter det med et nyt feedbacksystem. Du kan få flere oplysninger under:Indsend og få vist feedback om