serialize operator
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Marks that the order of the input row set is safe to use for window functions.
The operator has a declarative meaning. It marks the input row set as serialized (ordered), so that window functions can be applied to it.
Syntax
serialize [Name1 = Expr1 [, Name2 = Expr2]...]
Learn more about syntax conventions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| Name | string |
The name of the column to add or update. If omitted, the output column name is automatically generated. | |
| Expr | string |
✔️ | The calculation to perform over the input. |
Examples
Serialize subset of rows by condition
TraceLogs
| where ClientRequestId == "5a848f70-9996-eb17-15ed-21b8eb94bf0e"
| serialize
Add row number to the serialized table
To add a row number to the serialized table, use the row_number() function.
TraceLogs
| where ClientRequestId == "5a848f70-9996-eb17-15ed-21b8eb94bf0e"
| serialize rn = row_number()
Serialization behavior of operators
The output row set of the following operators is marked as serialized.
The output row set of the following operators is marked as nonserialized.
- count
- distinct
- evaluate
- facet
- join
- make-series
- mv-expand
- reduce by
- sample
- sample-distinct
- summarize
- top-nested
All other operators preserve the serialization property. If the input row set is serialized, then the output row set is also serialized.