Rediger

Del via

fork operator

  • Artikel

Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Runs multiple consumer operators in parallel.

Syntax

T | fork [name=](subquery) [name=](subquery) ...

Learn more about syntax conventions.

Parameters

Name Type Required Description
subquery string ✔️ A downstream pipeline of supported query operators.
name string A temporary name for the subquery result table.

Note

  • Avoid using fork with a single subquery.
  • The name of the results tab is the same name as provided with the name parameter or the as operator.

Supported query operators

Returns

Multiple result tables, one for each of the subquery arguments.

Tips

  • Use materialize as a replacement for join or union on fork legs. The input stream is cached by materialize and then the cached expression can be used in join/union legs.

  • Use batch with materialize of tabular expression statements instead of the fork operator.

Examples

The examples in this article use publicly available tables in the help cluster, such as the StormEvents table in the Samples database.

The examples in this article use publicly available tables, such as the StormEvents table in the Weather analytics sample data.

The examples output multiple tables, with named and umnamed columns.

Unnamed subqueries

StormEvents
| where State == "FLORIDA"
| fork
    ( where DeathsDirect + DeathsIndirect > 1)
    ( where InjuriesDirect + InjuriesIndirect > 1)

Output

This output shows the first few rows and columns of the result table.

StartTime EndTime EpisodeId EventId State EventType InjuriesDirect InjuriesIndirect
2007-02-02T03:17:00Z 2007-02-02T03:25:00Z 3464 18948 FLORIDA Tornado 10 0
2007-02-02T03:37:00Z 2007-02-02T03:55:00Z 3464 18950 FLORIDA Tornado 9 0
2007-03-13T08:20:00Z 2007-03-13T08:20:00Z 4094 22961 FLORIDA Dense Fog 3 0
2007-09-11T15:26:00Z 2007-09-11T15:26:00Z 9578 53798 FLORIDA Rip Current 0 0

Named subqueries

In the following examples, the result table is named "StormsWithDeaths" and "StormsWithInjuries".

StormEvents
| where State == "FLORIDA"
| fork
    (where DeathsDirect + DeathsIndirect > 1 | as StormsWithDeaths)
    (where InjuriesDirect + InjuriesIndirect > 1 | as StormsWithInjuries)

StormEvents
| where State == "FLORIDA"
| fork
    StormsWithDeaths = (where DeathsDirect + DeathsIndirect > 1)
    StormsWithInjuries = (where InjuriesDirect + InjuriesIndirect > 1)

Output

This output shows the first few rows and columns of the result table.

StartTime EndTime EpisodeId EventId State EventType InjuriesDirect InjuriesIndirect
2007-02-02T03:17:00Z 2007-02-02T03:25:00Z 3464 18948 FLORIDA Tornado 10 0
2007-02-02T03:37:00Z 2007-02-02T03:55:00Z 3464 18950 FLORIDA Tornado 9 0
2007-03-13T08:20:00Z 2007-03-13T08:20:00Z 4094 22961 FLORIDA Dense Fog 3 0
2007-09-11T15:26:00Z 2007-09-11T15:26:00Z 9578 53798 FLORIDA Rip Current 0 0