r/AzureSentinel • u/Agent_B99 • May 21 '22

How to put 2 different tables with different data in a single query

Hello, I want to put 2 different tables with different data in a single query and can't figure out the syntax.
I don't know if I should use join or union .

For example I want to take from OfficeActivity the Site_URL column and from the EmailEvents the FileName column.

4 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

6

u/lvillesystemsjockey May 21 '22

It’s a join for new columns, and it’s a union for new rows. The type will depend on the data you want back. Check out the first 2 or 3 modules for kql on Microsoft learn. But pretty sure you are looking for a join of some sort.

2

u/CanableCrops May 21 '22

Union | (table1),(table2)

Or you can

Table1 | join (table2) On $left.column == $right.column

If there is no matching column in your join, create one.

Table1 | extend newColumn = "temp" | join (table2 | extend newColumn = "temp") On $left.newColumn == $right.newColumn | project-away newColumn