你当前正在访问 Microsoft Azure Global Edition 技术文档网站。 如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站,请访问 https://docs.azure.cn

fork operator

Applies to: ✅Microsoft FabricAzure Data ExplorerAzure MonitorMicrosoft Sentinel

并行运行多个 consumer 运算符。

Syntax

T|fork [name=](subquery) [name=](subquery) ...

Learn more about syntax conventions.

Parameters

Name 类型 Required Description
subquery string ✔️ 支持的查询运算符的下游管道。
name string 子查询结果表的临时名称。

Note

  • Avoid using fork with a single subquery.
  • 结果选项卡的名称与 name 参数或 as 运算符提供的名称相同。

支持的查询运算符

Returns

Multiple result tables, one for each of the subquery arguments.

Tips

  • 在 fork 分支上,请使用 materialize 替换 joinunion。 输入流通过具体化进行缓存,然后缓存的表达式可用于联接/联合腿。

  • Use batch with materialize of tabular expression statements instead of the fork operator.

Examples

The examples in this article use publicly available tables in the help cluster, such as the StormEvents table in the Samples database.

The examples in this article use publicly available tables, such as the Weather table in the Weather analytics sample gallery. 可能需要修改示例查询中的表名称以匹配工作区中的表。

以下示例返回两个具有未命名列的表。

StormEvents
| where State == "FLORIDA"
| fork
    ( where DeathsDirect + DeathsIndirect > 1)
    ( where InjuriesDirect + InjuriesIndirect > 1)

Output

此输出显示结果表的前几行和列。

StartTime EndTime EpisodeId EventId State EventType InjuriesDirect InjuriesIndirect
2007-02-02T03:17:00Z 2007-02-02T03:25:00Z 3464 18948 FLORIDA Tornado 10 0
2007-02-02T03:37:00Z 2007-02-02T03:55:00Z 3464 18950 FLORIDA Tornado 9 0
2007-03-13T08:20:00Z 2007-03-13T08:20:00Z 4094 22961 FLORIDA Dense Fog 3 0
2007-09-11T15:26:00Z 2007-09-11T15:26:00Z 9578 53798 FLORIDA Rip Current 0 0

Named subqueries

在以下示例中,结果表名为“StormsWithDeaths”和“StormsWithInjuries”。

StormEvents
| where State == "FLORIDA"
| fork
    (where DeathsDirect + DeathsIndirect > 1 | as StormsWithDeaths)
    (where InjuriesDirect + InjuriesIndirect > 1 | as StormsWithInjuries)
StormEvents
| where State == "FLORIDA"
| fork
    StormsWithDeaths = (where DeathsDirect + DeathsIndirect > 1)
    StormsWithInjuries = (where InjuriesDirect + InjuriesIndirect > 1)

Output

此输出显示结果表的前几行和列。

StartTime EndTime EpisodeId EventId State EventType InjuriesDirect InjuriesIndirect
2007-02-02T03:17:00Z 2007-02-02T03:25:00Z 3464 18948 FLORIDA Tornado 10 0
2007-02-02T03:37:00Z 2007-02-02T03:55:00Z 3464 18950 FLORIDA Tornado 9 0
2007-03-13T08:20:00Z 2007-03-13T08:20:00Z 4094 22961 FLORIDA Dense Fog 3 0
2007-09-11T15:26:00Z 2007-09-11T15:26:00Z 9578 53798 FLORIDA Rip Current 0 0