project operator
Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Select the columns to include, rename or drop, and insert new computed columns.
The order of the columns in the result is specified by the order of the arguments. Only the columns specified in the arguments are included in the result. Any other columns in the input are dropped.
Syntax
T | project
[ColumnName | (
ColumnName[,
])
=
] Expression [,
...]
or
T | project
ColumnName [=
Expression] [,
...]
Learn more about syntax conventions.
Parameters
Name | Type | Required | Description |
---|---|---|---|
T | string |
✔️ | The tabular input for which to project certain columns. |
ColumnName | string |
A column name or comma-separated list of column names to appear in the output. | |
Expression | string |
The scalar expression to perform over the input. |
- Either ColumnName or Expression must be specified.
- If there's no Expression, then a column of ColumnName must appear in the input.
- If ColumnName is omitted, the output column name of Expression will be automatically generated.
- If Expression returns more than one column, a list of column names can be specified in parentheses. If a list of the column names isn't specified, all Expression's output columns with generated names will be added to the output.
Note
It's not recommended to return a new calculated column with the same name as an existing column in the input.
Returns
A table with columns that were named as arguments. Contains same number of rows as the input table.
Examples
The examples in this section show how to use the syntax to help you get started.
The examples in this article use publicly available tables in the help cluster, such as the
StormEvents
table in the Samples database.
The examples in this article use publicly available tables, such as the
StormEvents
table in the Weather analytics sample data.
Only show specific columns
Only show the EventId
, State
, EventType
of the StormEvents
table.
StormEvents
| project EventId, State, EventType
Output
The table shows the first 10 results.
EventId | State | EventType |
---|---|---|
61032 | ATLANTIC SOUTH | Waterspout |
60904 | FLORIDA | Heavy Rain |
60913 | FLORIDA | Tornado |
64588 | GEORGIA | Thunderstorm Wind |
68796 | MISSISSIPPI | Thunderstorm Wind |
68814 | MISSISSIPPI | Tornado |
68834 | MISSISSIPPI | Thunderstorm Wind |
68846 | MISSISSIPPI | Hail |
73241 | AMERICAN SAMOA | Flash Flood |
64725 | KENTUCKY | Flood |
... | ... | ... |
Potential manipulations using project
The following query renames the BeginLocation
column and creates a new column called TotalInjuries
from a calculation over two existing columns.
StormEvents
| project StartLocation = BeginLocation, TotalInjuries = InjuriesDirect + InjuriesIndirect
| where TotalInjuries > 5
Output
The table shows the first 10 results.
StartLocation | TotalInjuries |
---|---|
LYDIA | 15 |
ROYAL | 15 |
GOTHENBURG | 9 |
PLAINS | 8 |
KNOXVILLE | 9 |
CAROL STREAM | 11 |
HOLLY | 9 |
RUFFIN | 9 |
ENTERPRISE MUNI ARPT | 50 |
COLLIERVILLE | 6 |
... | ... |