mv-apply causes the value of ingestion_time() to be blanked out

Viewed 165

When you use mv-apply, ingestion_time() no longer has a value. This makes it excessively difficult in some cases.

For example, if a function uses mv-apply to do some processing, the consumer of the function can no longer use ingestion_time() to quickly filter down to recent rows ingested.

We can't use the workaround of 'project-rename' to expose the value, because project-rename won't work on ingestion_time()

1 Answers

Once you apply mv-apply / mv-expand, the data is no longer 'attached' to a data shard, and therefore ingestion_time() becomes null.

Instead of running:

T
| mv-expand d // or `mv-apply ...`
| extend ingestion_time()

you should run:

T
| extend ChooseAColumnName = ingestion_time() 
| mv-expand d // or `mv-apply ...`
Related