Merge two tables with different column names KQL

Question

I have two tables IdentityInfo and AuditLogs so I need to merge with these two columns AccountDisplayName(IdentityInfo) and Identity(AuditLogs). I found this on microsoft information but no information related with this issue.

IdentityInfo
|join kind=inner AuditLogs on AccountDisplayName,[CommonField]

Thanks in advance!

Answer 1

Assuming that by merge you mean join, and that the value in the column AccountDisplayName have an equality match with those in the column Identity, then the following should work.

Though, you probably want to apply filters/aggregations on at least one of the join legs, depending on the size of the data sets being joined.

IdentityInfo
| join kind=inner AuditLogs on $left.AccountDisplayName == $right.Identity

Documentation of the join operator: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/joinoperator