Fabric RTI 101: Using Wildcards with Union

In KQL, the union operator can combine results from multiple tables, even when those tables follow a naming pattern. This is particularly useful in environments where data is split across many similar tables — for example, logs_2024_01, logs_2024_02, and so on.

You can use wildcards with the union operator to simplify these queries. Instead of listing each table individually, you can write:

union withsource=TableName logs_*

This automatically brings together all tables whose names begin with logs_.

Using Wildcards with Union

The optional withsource= parameter records the name of the source table in the results, so you can identify which table each row came from.

This pattern is especially useful in multi-tenant or time-partitioned scenarios — for instance, when each customer or month has its own table.

However, make sure that the schemas across all matching tables are compatible. If columns differ, KQL aligns them based on name, but missing columns will appear as nulls.

Overall, using wildcards with union can significantly reduce query complexity while maintaining flexibility across large or segmented datasets.

Learn more about Fabric RTI

If you really want to learn about RTI right now, we have an online on-demand course that you can enrol in, right now. You’ll find it at Mastering Microsoft Fabric Real-Time Intelligence

2026-09-16