Combines events from two or more datasets, returning rows from each of them. This operator processes rows sourced from multiple datasets into a set of results. Based on the set union principle from mathematics, union is ideal for merging data from multiple sources for comprehensive data analysis.

Syntax

['DatasetA']
| union ['DatasetB', 'DatasetC', ...]

Arguments

nametypedescription
Dataset namestringName of the dataset to be included in the union. Multiple datasets can be included in the union.

Returns

A combined event comprising all rows from the included datasets. If fields overlap, they are merged. Non-overlapping fields are retained in their original form.

Examples

Basic union

Combines all rows from github-push-event and github-pull-request-event without any transformation or filtering.

['github-push-event']
| union ['github-pull-request-event']

Run in Playground

Filtering after union

Combines the datasets, and then filters the data to only include rows where the method is GET.

['sample-http-logs']
| union ['github-issues-event']
| where method == "GET"

Run in Playground

Aggregating after union

Combines the datasets and summarizes the data, counting the occurrences of each combination of content_type and actor.

['sample-http-logs']
| union ['github-pull-request-event']
| summarize Count = count() by content_type, actor

Run in Playground