Edit

fork operator

  • Article

Runs multiple consumer operators in parallel.

Syntax

T | fork [name=](subquery) [name=](subquery) ...

Learn more about syntax conventions.

Parameters

Name Type Required Description
subquery string ✔️ A downstream pipeline of supported query operators.
name string A temporary name for the subquery result table.

Note

  • Avoid using fork with a single subquery.
  • The name of the results tab will be the same name as provided with the name parameter or the as operator.

Supported query operators

Returns

Multiple result tables, one for each of the subquery arguments.

Tips

  • Use materialize as a replacement for join or union on fork legs. The input stream will be cached by materialize and then the cached expression can be used in join/union legs.

  • Use batch with materialize of tabular expression statements instead of the fork operator.

Examples

Unnamed subqueries

Run the query

StormEvents
| where State == "FLORIDA"
| fork
    ( where DeathsDirect + DeathsIndirect > 1)
    ( where InjuriesDirect + InjuriesIndirect > 1)

Named subqueries

In the following examples, the result tables will be named "StormsWithDeaths" and "StormsWithInjuries".

Run the query

StormEvents
| where State == "FLORIDA"
| fork
    (where DeathsDirect + DeathsIndirect > 1 | as StormsWithDeaths)
    (where InjuriesDirect + InjuriesIndirect > 1 | as StormsWithInjuries)

Run the query

StormEvents
| where State == "FLORIDA"
| fork
    StormsWithDeaths = (where DeathsDirect + DeathsIndirect > 1)
    StormsWithInjuries = (where InjuriesDirect + InjuriesIndirect > 1)

This capability isn't supported in Azure Monitor