fork operator

Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Runs multiple consumer operators in parallel.

Syntax

T | fork [name=](subquery) [name=](subquery) ...

Learn more about syntax conventions.

Parameters

Name	Type	Required	Description
subquery	string	✔️	A downstream pipeline of supported query operators.
name	string		A temporary name for the subquery result table.

Note

• Avoid using fork with a single subquery.
• The name of the results tab will be the same name as provided with the name parameter or the as operator.

Supported query operators

• as
• count
• extend
• parse
• where
• take
• project
• project-away
• project-keep
• project-rename
• project-reorder
• summarize
• top
• top-nested
• sort
• mv-expand
• reduce

Returns

Multiple result tables, one for each of the subquery arguments.

Tips

• Use materialize as a replacement for join or union on fork legs. The input stream will be cached by materialize and then the cached expression can be used in join/union legs.

• Use batch with materialize of tabular expression statements instead of the fork operator.

Examples

Unnamed subqueries

Run the query

StormEvents
| where State == "FLORIDA"
| fork
    ( where DeathsDirect + DeathsIndirect > 1)
    ( where InjuriesDirect + InjuriesIndirect > 1)

Named subqueries

In the following examples, the result tables will be named "StormsWithDeaths" and "StormsWithInjuries".

Run the query

StormEvents
| where State == "FLORIDA"
| fork
    (where DeathsDirect + DeathsIndirect > 1 | as StormsWithDeaths)
    (where InjuriesDirect + InjuriesIndirect > 1 | as StormsWithInjuries)

Run the query

StormEvents
| where State == "FLORIDA"
| fork
    StormsWithDeaths = (where DeathsDirect + DeathsIndirect > 1)
    StormsWithInjuries = (where InjuriesDirect + InjuriesIndirect > 1)