Returns a dynamic array with the tags of the data shard ("extent") that the current record is in.
If you apply this function to calculated data, which isn't attached to a data shard, returns an empty value.
A value of type
dynamic that is an array holding the current record's extent tags,
or an empty value.
Some query operators preserve the information about the data shard hosting the record.
These operators include
The following example shows how to get a list the tags of all the data shards
that have records from an hour ago, with a specific value for the
T | where Timestamp > ago(1h) | where ActivityId == 'dd0595d4-183e-494e-b88e-54c52fe90e5a' | extend tags = extent_tags() | summarize by tostring(tags)
The following example shows how to obtain a count of all records from the last hour, which are stored in extents tagged with the tag
MyTag(and potentially other tags), but not tagged with the tag
T | where Timestamp > ago(1h) | extend Tags = extent_tags() | where Tags has_cs 'MyTag' and Tags !has_cs 'drop-by:MyOtherTag' | count
Filtering on the value of
extent_tags() performs best when one of the following string operators is used:
This capability isn't supported in Azure Monitor