Kusto KQL - Part 3C - Output Displays - Project, Render, Extend

Project

Project lets you change values on output. Other options with project are 'project-away', 'project-keep', 'project-rename' (allows you to map an original field to its normalized name. this operator ensures that the field is still managed as a physical field and that handling the field is more performant)., 'project-reorder'.

| project FreeGB=CounterValue / 1024

Other project ideas:

| project <NewColumnName1> = <ExistingColumnName1>, <NewColumnName2> = <ExistingColumnName2> + 10

Other project options:

project-reorder

project-away

Render

Displays the data visually.

| summarize count() by bin(TimeGenerated, 1d)
| render barchart

Data limitations of Render views:

• areachart – Area graph. The first column is the x-axis and should be a numeric column. Other numeric columns are y-axes.

• barchart – First column is the x-axis and can be text, datetime or numeric. Other columns are numeric, displayed as horizontal strips.

• columnchart – same as barchart.

• piechart – First column is color-axis, second column is numeric.

• scatterchart – Points graph. The first column is the x-axis and should be a numeric column. Other numeric columns are y-axes.

• table – this is the default view.

• timechart – Line graph. The first column is x-axis, and should be datetime. Other (numeric) columns are y-axes.

Extend

Allows you to create columns on the fly. A popular extend is data value conversions where the default value may be something like MegaBytes (MB).

If the OriginalCounterValue field is in GB

| extend FreeMB = OriginalCounterValue

Converting the OriginalCounterValue field to GB.

| extend FreeMB = OriginalCounterValue / 1024

Converting the OriginalCounterValue field to KB.

| extend FreeMB = OriginalCounterValue * 1024