I am trying to write a KQL query to get exceptions together with requests which satisfy a given where clause. The where clause applies only to the requests table. In other words, I want to make the union of the exceptions table with a second table which is requests, filtered by a where clause.
I started with
exceptions
| union requests
and I do not know how to specify the where clause for the requests table. It would be
where name contains "health" and success == false
I could not figure this out based on the existing examples.
Can anyone help? Thanks in advance!
>Solution :
It is covered by the documentation, including multiple examples.
union exceptions, (requests | where name contains "health" and success == false)
or
exceptions
| union (requests | where name contains "health" and success == false)