Fabric RTI 101: KQL Projections, Extensions, and Aliases

In KQL, projections are how you shape your dataset — deciding which columns to keep, how to name them, and even adding new ones on the fly.

The main operator for this is project. It lets you select only the columns you need, and at the same time, you can rename columns using aliases to make your results more meaningful or easier to read. For example:

Events
| project Time = Timestamp, User = UserId, Message

Here, the column Timestamp is renamed to Time, and UserId becomes User. This makes your results cleaner and easier to understand — especially when you’re building queries for dashboards or reports.

You can also use the extend operator to create new calculated columns. For example:

| extend DurationSeconds = Duration / 1000

That adds a new field derived from existing data without changing the original table.

These projection and extension steps are often used together — first extending your dataset with new values, then projecting only the columns you actually want to keep. This approach helps prepare your data for downstream analysis, whether that’s grouping, summarizing, or visualizing it.

Conceptually, this is similar to SQL’s SELECT clause, but in KQL it’s broken into smaller, composable steps that make complex queries easier to build and maintain. Once you get used to using project and extend, you’ll find that shaping your data in KQL feels both structured and intuitive.

Learn more about Fabric RTI

If you really want to learn about RTI right now, we have an online on-demand course that you can enrol in, right now. You’ll find it at Mastering Microsoft Fabric Real-Time Intelligence

2026-06-12