KQL Tutorial Series | Joining Tables (Demo) | EP5

[@olafhoogstad446]

Good morning :) A BIG thank you from me for explaining KQL so well and in an easy to understand way! You ae a KQL life saver for me :)

[@JackSmith-oy7rx]

Struggled with joins and kept giving up for some time now.. this is an awesome video thanks to the easy and simple table example and showing the outputs and even the ability to work with the data yourself. Thank you!

[@TeachJing]

I’m glad it helped!

[@patrickoleary1454]

Wonderful series!! I hope you add more to this. Unions as suggested below would be amazing, Aggregations also.

[@TeachJing]

Okay! Any use case in particular?

[@georgeollis]

This is a brilliant video Jing! Thanks so much

[@TeachJing]

You are very welcome

[@GauravGupta86]

Very well simple explanation ! good stuff

[@truthhertz10]

Some VERY controversial MD levels here, surprised this video hasn't made the news... But great video and incredible series! You explain things in such an easy to grasp way specially with examples and follow-alongs, really good to use to learn/brush up on KQL.

[@his-worddevotionals540]

excellent! thank you Jing!

[@iamFlakey]

Well done dude, I appreciate this!

[@avishalom14]

Great explanation, thanks!

[@TeachJing]

Glad it was helpful!

[@rahul53403]

good job !!

[@sdrawkcab8911]

Great video, also just wanted to let you know that I was sent here by one of your interns. 😂

[@atul2651]

Thanks for the video, quick query: Is there anyway to join more than 2 tables ?

[@thrinathkumar8749]

Thanks👍

[@TeachJing]

Your welcome!

[@thrinathkumar8749]

can you kindly make a video on unions too?

[@Sharlie909]

Nice vid!!! 🦾

[@KenseiOtaku]

Hi, great tutorial! Question - how to join two tables without a common column field. If table A has a name1 column and table B has a name2 column (both columns unique, but contain the same data just the columns are called differently).

[@TeachJing]

You can either rename the column with project-rename so it’s the same column name docs.microsoft.com/en-us/azure/data-explorer/kusto/query/projectrenameoperator Or you can just identify the columns you wanna match against. Table1 | join Table2 on $left.columnName == $right.columnName docs.microsoft.com/en-us/azure/data-explorer/kusto/query/joinoperator?pivots=azuredataexplorer

[@KenseiOtaku]

@@TeachJing Thank you so much you're a genius! Subbed

[@arshad801]

Can you please show demo on regex with in kusto..either in adx or sentinel?

[@bharadwaj2008]

Heyy Jing, thank you very much for your content. I am about to start an internship where I have to work on Azure sentinel database with kql and produce reports. Your content gave me the perfect kickstart. I do have a few questions if you could answer them: 1) There are tutorials online that use tables like StormEvents and Perf in the azure Log Analytics database, but I get no returned records when I use them. Why is that so? 2) And please add more to this series:)) Thank you very much.

[@Robertorossell]

Thanks

[@terribletheo8401]

I did a "Table1 | join (Table2) on Name;" and got the same result as in 2:35, however I also got a "name1" column containing the same values as "name". What's up with that?

[@TeachJing]

That will happen and you just need to remove one of them. It basically joined both tables but kept both columns too. You can do project-away name1 or now just filter the columns you want to keep after joining.

[@SuperTechnicalman]

I want to join 2 tables in a workbook. one table has IntuneDevices has DeviceName and AppInventory_CL has ComputerName_s. How do i link those together?

[@PCtutorialKid]

What if you want to join on a column that has a different name in each table but same values?

[@TeachJing]

You can specify keys for each column you want to link. Table1 | join (Table2) on CommonColumn, $left.col1 == $right.col2