fork operator

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Runs multiple consumer operators in parallel.

Syntax

T | fork [name=](subquery) [name=](subquery) ...

Learn more about syntax conventions.

Parameters

Name Type Required Description
subquery string ✔️ A downstream pipeline of supported query operators.
name string A temporary name for the subquery result table.

Note

  • Avoid using fork with a single subquery.
  • The name of the results tab will be the same name as provided with the name parameter or the as operator.

Supported query operators

Returns

Multiple result tables, one for each of the subquery arguments.

Tips

  • Use materialize as a replacement for join or union on fork legs. The input stream will be cached by materialize and then the cached expression can be used in join/union legs.

  • Use batch with materialize of tabular expression statements instead of the fork operator.

Examples

Unnamed subqueries

StormEvents
| where State == "FLORIDA"
| fork
    ( where DeathsDirect + DeathsIndirect > 1)
    ( where InjuriesDirect + InjuriesIndirect > 1)

Named subqueries

In the following examples, the result tables will be named "StormsWithDeaths" and "StormsWithInjuries".

StormEvents
| where State == "FLORIDA"
| fork
    (where DeathsDirect + DeathsIndirect > 1 | as StormsWithDeaths)
    (where InjuriesDirect + InjuriesIndirect > 1 | as StormsWithInjuries)

StormEvents
| where State == "FLORIDA"
| fork
    StormsWithDeaths = (where DeathsDirect + DeathsIndirect > 1)
    StormsWithInjuries = (where InjuriesDirect + InjuriesIndirect > 1)