fork operator
Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Runs multiple consumer operators in parallel.
T |
fork
[name=
](
subquery)
[name=
](
subquery)
...
Learn more about syntax conventions.
Name | Type | Required | Description |
---|---|---|---|
subquery | string |
✔️ | A downstream pipeline of supported query operators. |
name | string |
A temporary name for the subquery result table. |
Note
- Avoid using
fork
with a single subquery. - The name of the results tab will be the same name as provided with the
name
parameter or theas
operator.
as
count
extend
parse
where
take
project
project-away
project-keep
project-rename
project-reorder
summarize
top
top-nested
sort
mv-expand
reduce
Multiple result tables, one for each of the subquery arguments.
Use
materialize
as a replacement forjoin
orunion
on fork legs. The input stream will be cached by materialize and then the cached expression can be used in join/union legs.Use batch with
materialize
of tabular expression statements instead of thefork
operator.
StormEvents
| where State == "FLORIDA"
| fork
( where DeathsDirect + DeathsIndirect > 1)
( where InjuriesDirect + InjuriesIndirect > 1)
In the following examples, the result tables will be named "StormsWithDeaths" and "StormsWithInjuries".
StormEvents
| where State == "FLORIDA"
| fork
(where DeathsDirect + DeathsIndirect > 1 | as StormsWithDeaths)
(where InjuriesDirect + InjuriesIndirect > 1 | as StormsWithInjuries)
StormEvents
| where State == "FLORIDA"
| fork
StormsWithDeaths = (where DeathsDirect + DeathsIndirect > 1)
StormsWithInjuries = (where InjuriesDirect + InjuriesIndirect > 1)