createview

Use the createview command to define a subquery to create a subset of groups identified by the link command. This virtual set of groups will in turn be used in other commands for further computations.

Syntax:

createview <subquery> as <view_name>

Parameters

The following table lists the parameters used in this command, along with their descriptions.

Parameter Description

subquery

The subquery to create a subset of groups. The subquery must use the rename to expose fields that need to made available when this view is used.

view_name

The name of the view.

For examples of using this command in typical scenarios, see:

The following command creates Application Error View view of all the entity groups with application error:

* | link Entity, Label 
  | createview [ 
    * | where Label = 'Application Error' 
    | rename Entity as 'Application Error Entity' 
    ] as 'Application Error View'