extent_tags()

Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Returns a dynamic array with the extent tags of the extent that the current record is in.

If you apply this function to calculated data, which isn't attached to a data shard, returns an empty value.

Syntax

extent_tags()

Learn more about syntax conventions.

Returns

A value of type dynamic that is an array holding the current record's extent tags, or an empty value.

Examples

Some query operators preserve the information about the data shard hosting the record. These operators include where, extend, and project. The following example shows how to get a list the tags of all the data shards that have records from an hour ago, with a specific value for the column ActivityId.

T
| where Timestamp > ago(1h)
| where ActivityId == 'dd0595d4-183e-494e-b88e-54c52fe90e5a'
| extend tags = extent_tags()
| summarize by tostring(tags)

The following example shows how to obtain a count of all records from the last hour, which are stored in extents tagged with the tag MyTag(and potentially other tags), but not tagged with the tag drop-by:MyOtherTag.

T
| where Timestamp > ago(1h)
| extend Tags = extent_tags()
| where Tags has_cs 'MyTag' and Tags !has_cs 'drop-by:MyOtherTag'
| count

Note

Filtering on the value of extent_tags() performs best when one of the following string operators is used: has, has_cs, !has, !has_cs.